CVE-2026-31629

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31629
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED checks In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly calls release_sock() and nfc_llcp_sock_put() but fails to return. Execution falls through to the remainder of the function, which calls release_sock() and nfc_llcp_sock_put() again. This results in a double release_sock() and a refcount underflow via double nfc_llcp_sock_put(), leading to a use-after-free. Add the missing return statements after the LLCP_CLOSED branches in both functions to prevent the fall-through.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf Patch
https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c Patch
https://git.kernel.org/stable/c/665315df9c3486cb213fc44d83cc8bcd47fe0d26
https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2 Patch
https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf Patch
https://git.kernel.org/stable/c/9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6
https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6 Patch
https://git.kernel.org/stable/c/b2a23529593d011fb433a3d711fc597ed6a6bd2f
https://git.kernel.org/stable/c/ff3d9e8f7244293e303f7b6ef70774291c7c27e9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

01 Jun 2026, 17:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/665315df9c3486cb213fc44d83cc8bcd47fe0d26 -
  • () https://git.kernel.org/stable/c/9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6 -
  • () https://git.kernel.org/stable/c/b2a23529593d011fb433a3d711fc597ed6a6bd2f -

27 Apr 2026, 20:36

Type Values Removed Values Added
CWE CWE-667
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf - () https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf - Patch
References () https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c - () https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c - Patch
References () https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2 - () https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2 - Patch
References () https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf - () https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf - Patch
References () https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6 - () https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6 - Patch
References () https://git.kernel.org/stable/c/ff3d9e8f7244293e303f7b6ef70774291c7c27e9 - () https://git.kernel.org/stable/c/ff3d9e8f7244293e303f7b6ef70774291c7c27e9 - Patch

27 Apr 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

27 Apr 2026, 14:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf -

27 Apr 2026, 12:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c -

24 Apr 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-24 15:16

Updated : 2026-06-01 17:16

NVD link : CVE-2026-31629

Mitre link : CVE-2026-31629

CVE.ORG link : CVE-2026-31629

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking