In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix circular locking dependency in nci_close_device
nci_close_device() flushes rx_wq and tx_wq while holding req_lock.
This causes a circular locking dependency because nci_rx_work()
running on rx_wq can end up taking req_lock too:
nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
-> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
-> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)
Move the flush of rx_wq after req_lock has been released.
This should safe (I think) because NCI_UP has already been cleared
and the transport is closed, so the work will see it and return
-ENETDOWN.
NIPA has been hitting this running the nci selftest with a debug
kernel on roughly 4% of the runs.
References
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 15:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/09143c0e8f3b03517e6233aad42f45c794d8df8e - Patch | |
| References | () https://git.kernel.org/stable/c/1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289 - Patch | |
| References | () https://git.kernel.org/stable/c/4527025d440ce84bf56e75ce1df2e84cb8178616 - Patch | |
| References | () https://git.kernel.org/stable/c/5eef9ebec7f5738f12cadede3545c05b34bf5ac3 - Patch | |
| References | () https://git.kernel.org/stable/c/7ed00a3edc8597fe2333f524401e2889aa1b5edf - Patch | |
| References | () https://git.kernel.org/stable/c/ca54e904a071aa65ef3ad46ba42d51aaac6b73b4 - Patch | |
| References | () https://git.kernel.org/stable/c/d89b74bf08f067b55c03d7f999ba0a0e73177eb3 - Patch | |
| References | () https://git.kernel.org/stable/c/eb435d150ca74b4d40f77f1a2266f3636ed64a79 - Patch | |
| CWE | CWE-667 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-04-28 15:02
NVD link : CVE-2026-31509
Mitre link : CVE-2026-31509
CVE.ORG link : CVE-2026-31509
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-667
Improper Locking