Linux Kernel CVE-2026-31509

The vulnerability exists in the Linux kernel's NFC (Near Field Communication) subsystem, specifically in the NCI (NFC Controller Interface) layer within nci_close_device(). The root cause (CWE-667: Improper Locking) stems from a circular lock dependency: nci_close_device() acquires req_lock (a mutex) and then flushes rx_wq and tx_wq work queues. However, nci_rx_work() running on rx_wq can trigger a call chain (nci_rx_data_packet → nci_data_exchange_complete → __sk_destruct → rawsock_destruct → nfc_deactivate_target → nci_deactivate_target → nci_request) that also attempts to acquire req_lock. This creates a deadlock scenario where the work queue flush cannot complete because the worker thread is blocked waiting for the same lock held by the flushing context. The fix relocates the rx_wq flush after req_lock is released, relying on the NCI_UP flag being cleared and transport closure to cause the work to exit early with -ENETDOWN.