CVE-2026-46267: Linux NFC SHDLC Use-After-Free Privilege Escalation

Technical summary

The vulnerability resides in the NFC HCI SHDLC implementation within the Linux kernel. Specifically, the llc_shdlc_deinit() function purges socket buffer (skb) queues and deallocates the llc_shdlc structure without first stopping active timers and canceling the state machine work queue handler (sm_work). Since timer callbacks can schedule sm_work, and sm_work itself accesses SHDLC state and skb queues, a race condition exists: if teardown occurs concurrently with a pending or executing work item, the work handler will dereference memory that has already been freed. This is a classic use-after-free (UAF) scenario. The issue was discovered through automated static analysis using the SVACE tool by the Linux Verification Center.

Business impact

This vulnerability affects any Linux system running affected kernel versions where NFC functionality is compiled or available. While NFC is not universally deployed, it is present in certain enterprise environments, IoT deployments, and consumer devices. Exploitation could result in denial of service (kernel crash), information disclosure via memory corruption, or privilege escalation from unprivileged user context to kernel-level execution. The impact is localized to machines with NFC capabilities and requires local access, limiting the scope compared to remote exploits, but the severity remains elevated given the potential for privilege escalation.

Affected systems

The Linux kernel across all versions prior to the patch is affected. NFC support must be compiled into or loaded as a module for the vulnerability to be exploitable. Systems with NFC hardware (such as embedded devices, NFC readers, or NFC-capable phones running Linux) are directly at risk. Servers and desktops without NFC support are not vulnerable. Verify your kernel configuration to determine if CONFIG_NFC and related SHDLC modules are enabled.

Exploitability

Exploitation requires local system access with basic unprivileged user privileges. An attacker would need to trigger NFC device initialization and then concurrent teardown with active timers or work queue operations. While not trivial, this is feasible in scenarios where an attacker controls local user accounts or has access to the NFC subsystem. The vulnerability does not require special hardware beyond standard NFC support; it is a race condition that can be triggered through normal driver lifecycle operations. Public exploit code is not known at this time, but the root cause is straightforward enough that a motivated attacker could develop a proof-of-concept.

Remediation

Apply the kernel patch that modifies llc_shdlc_deinit() to synchronously stop all timers and cancel sm_work before purging queues and freeing the llc_shdlc structure. The fix ensures proper cleanup ordering to eliminate the race window. End users should upgrade to a patched kernel version released by their Linux distribution or kernel maintainers. Verify against official Linux kernel security advisories and your vendor's kernel update schedule for specific version numbers and availability.

Patch guidance

Linux kernel maintainers have released a fix as part of standard kernel updates. Contact your distribution maintainer (Red Hat, Canonical, SUSE, etc.) for the specific patched kernel version applicable to your release. The patch involves reordering the deinit sequence to call timer_stop and cancel_work_sync before queue purge and structure deallocation. Verify the patch in the Linux kernel git repository under the NFC subsystem commits. Test patches in a non-production environment before deployment to ensure stability and compatibility with your NFC-dependent services.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for NFC SHDLC driver errors, NULL pointer dereferences, or use-after-free warnings. Kernel Address Sanitizer (KASAN) enabled kernels will reliably catch UAF attempts at runtime with detailed stack traces. Runtime behavioral indicators include unexpected NFC device initialization/teardown crashes or memory corruption warnings. Intrusion detection systems should flag suspicious patterns of repeated NFC subsystem activation and deactivation on systems where such activity is anomalous. However, normal detection of active exploitation in production is challenging; the primary detection strategy is proactive patching.

Why prioritize this

Despite requiring local access, this vulnerability warrants prioritization because it enables privilege escalation from user context to kernel execution, has a relatively high CVSS score of 7.8, and affects a foundational kernel subsystem. Systems with NFC enabled should prioritize patching immediately. Systems without NFC can safely defer this patch or deprioritize relative to remote code execution vulnerabilities, but organizations should audit their kernel configurations to determine NFC status. The fact that this is a kernel-level vulnerability means successful exploitation could compromise the entire system.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) Local attack vector requiring user-level access but not administrative privileges; (2) Low attack complexity—the race condition can be triggered reliably; (3) High impact across confidentiality, integrity, and availability due to kernel-level execution potential; (4) No user interaction required. The score appropriately captures the severity while acknowledging the local-access requirement, making this a high-priority but not critical vulnerability.

Frequently asked questions