CVE-2026-46267

HighCVSS 7.8/10Last modified Jul 22, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: shdlc: Stop timers and work before freeing context

llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm_work synchronously before purging the queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 4a61cd6687fc6348d08724676d34e38160d6cf9b, < c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e; >= 4a61cd6687fc6348d08724676d34e38160d6cf9b, < a24a676329d40481b2331bfa1418a679577dfd3a; >= 4a61cd6687fc6348d08724676d34e38160d6cf9b, < 77eef9f2eef045c3c37a3df82d3e661afb866b98; >= 4a61cd6687fc6348d08724676d34e38160d6cf9b, < cf70cedce327833296ebe6043364d1e44b76a2ab; >= 4a61cd6687fc6348d08724676d34e38160d6cf9b, < 276820278e9717cc7d4bb32381892dd3ddf418d4; >= 4a61cd6687fc6348d08724676d34e38160d6cf9b, < 1cb97b1225450af3f7b728777929ba50c6a58ced; >= 4a61cd6687fc6348d08724676d34e38160d6cf9b, < c9efde1e537baed7648a94022b43836a348a074f
LinuxLinux3.7

References

Timeline

Published
Jun 3, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-462685.5In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition Commit b7e282378CVE-2026-462695.5In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix NULL pointer dereference when parsing deviceCVE-2026-46277.2A vulnerability was found in D-Link DIR-825 and DIR-825R 1.0.5/4.5.1. Affected is the function handler_update_system_time of the file libdeuCVE-2026-462708.4In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() UsCVE-2026-462717.8In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads only on primary link In case of multi-liCVE-2026-462724.7In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysfs and perf mode WheCVE-2026-462738.6In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adaptersCVE-2026-462747.8In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() CVE-2026-462757.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init patCVE-2026-462765.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix zero-size GDS range init on RDNA4 RDNA4 (GFX 12) hardwCVE-2026-462777.8In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() CVE-2026-462785.5In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix segfault when updating ftrace mask Fix invalid da
CVE-2026-46267: High severity, CVSS 7.8 | Vulnix