CVE-2026-46267: nfc: hci: shdlc: Stop timers and work before freeing context
In the Linux kernel, the following vulnerability has been resolved:
nfc: hci: shdlc: Stop timers and work before freeing context
llcshdlcdeinit() purges SHDLC skb queues and frees the llcshdlc structure while its timers and state machine work may still be active.
Timer callbacks can schedule smwork, and smwork accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races.
Stop all SHDLC timers and cancel smwork synchronously before purging the queues and freeing the context.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46267?
CVE-2026-46267 is rated with a risk severity of 40.
How do I fix CVE-2026-46267?
To fix CVE-2026-46267, update the Linux kernel to the latest version where this vulnerability has been addressed.
What components are affected by CVE-2026-46267?
CVE-2026-46267 affects the NFC subsystem in the Linux kernel, specifically related to SHDLC context management.
Can CVE-2026-46267 lead to system instability?
Yes, CVE-2026-46267 can lead to system instability due to improper handling of timers and state machines.
Is CVE-2026-46267 publicly disclosed?
Yes, CVE-2026-46267 was publicly disclosed on June 3, 2026.