CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks
In multiple functions of llcpcore.c, there is a possible use after free due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: add missing return after LLCPCLOSED checks
In nfcllcprecvhdlc() and nfcllcprecvdisc(), when the socket state is LLCPCLOSED, the code correctly calls releasesock() and nfcllcpsockput() but fails to return. Execution falls through to the remainder of the function, which calls releasesock() and nfcllcpsockput() again. This results in a double releasesock() and a refcount underflow via double nfcllcpsockput(), leading to a use-after-free.
Add the missing return statements after the LLCPCLOSED branches in both functions to prevent the fall-through.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2026-09-05 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Add missing return statements immediately after the LLCP_CLOSED checks in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc() in llcp_core.c to prevent fall-through and avoid double release_sock() and nfc_llcp_sock_put() calls.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31629?
CVE-2026-31629 is classified as a low-severity vulnerability affecting the Linux kernel.
What does CVE-2026-31629 affect?
CVE-2026-31629 affects the Linux kernel versions ranging from 3.3 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, and 7.0 to 7.0.1.
How do I fix CVE-2026-31629?
To fix CVE-2026-31629, update your Linux kernel to a patched version that addresses this vulnerability.
What are the implications of CVE-2026-31629?
The implications of CVE-2026-31629 include potential socket state mismanagement in the NFC protocol, which may lead to resource leaks.
How was CVE-2026-31629 resolved?
CVE-2026-31629 was resolved by adding a missing return statement after LLCP_CLOSED checks in specific functions within the Linux kernel.