Skip to main content

Linux Kernel CVE-2026-46267

| EUVDEUVD-2026-34129 HIGH
Use After Free (CWE-416)
2026-06-03 Linux GHSA-c9pp-c247-8xgh
Information Disclosure Use After Free Memory Corruption Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 09, 2026 - 19:53 vuln.today
CVSS changed
Jun 09, 2026 - 19:52 NVD
7.8 (HIGH)
Patch available
Jun 03, 2026 - 19:01 EUVD
CVE Published
Jun 03, 2026 - 15:50 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 03, 2026 - 15:50 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: shdlc: Stop timers and work before freeing context

llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm_work synchronously before purging the queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

AnalysisAI

Use-after-free in the Linux kernel NFC HCI SHDLC subsystem allows local low-privileged attackers to corrupt memory and potentially escalate privileges by triggering teardown races against active timers and queued work items. The flaw exists because llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while timers and the sm_work state-machine handler may still execute concurrently. EPSS is very low (0.02%) and no public exploit identified at time of analysis, but the high-impact CVSS (7.8) reflects full CIA compromise on successful exploitation.

Technical ContextAI

The vulnerability lives in drivers/nfc/hci/shdlc.c, which implements the Simplified High-level Data Link Control protocol used by the NFC HCI (Host Controller Interface) layer for communication with NFC chipsets. SHDLC uses kernel timers and a workqueue item (sm_work) to drive its state machine and manage retransmission/acknowledgment of NFC frames. The CWE-416 (Use-After-Free) root cause is a classic teardown race: timer callbacks can still schedule sm_work, and sm_work dereferences the llc_shdlc context and its skb queues after llc_shdlc_deinit() has freed them. The fix synchronously stops timers and cancels sm_work before the queues are purged and the structure is freed, eliminating the window where freed memory can be reaccessed.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable release - 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4, or 7.0 - or pick up the upstream commits referenced at https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98, https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e, https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a, https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab, https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4, https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced, and https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f, then track your distribution's advisory for the corresponding backport. On systems that do not require NFC, a strong compensating control is to blacklist or unload the NFC HCI/SHDLC modules (for example, blacklist nfc, nfc_hci and shdlc in /etc/modprobe.d/) which eliminates the vulnerable code path entirely at the cost of disabling NFC functionality. Where NFC is required, restrict physical and local user access to NFC hardware and avoid hot-attach/detach sequences from untrusted local users until patched; SELinux/AppArmor policies and seccomp can further limit which processes can interact with /dev/nfc* nodes, with the trade-off of needing per-application policy tuning.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-46267 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy