CVE-2026-64010 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and take steps to ensure their systems are updated. They should review system configurations and ensure NFC LLCP is not exposed to untrusted networks. They should also monitor system logs for potential exploitation attempts.

Technical summary

The vulnerability is caused by a race condition in the NFC LLCP connection state machine where the connection acceptance packet (CC) can be processed concurrently with socket release. This can lead to a use-after-free of the socket object. The issue is resolved by holding the lock_sock() during the state transition and list movement in nfc_llcp_recv_cc(). After acquiring the lock, check if the socket is still hashed to ensure it hasn't already been unlinked and marked for destruction by the release path. This aligns the locking pattern with recv_hdlc() and recv_disc().

Defensive priority

Medium

Recommended defensive actions

• Update Linux kernel to the latest version
• Review system configurations and ensure NFC LLCP is not exposed to untrusted networks
• Monitor system logs for potential exploitation attempts
• Perform a thorough review of the system to identify potential vulnerabilities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-19T16:17:40.803Z and has not been modified since then. The NVD entry is currently Received. There is a use-after-free vulnerability in the Linux kernel's NFC LLCP connection state machine. The issue arises when processing the connection acceptance packet (CC) concurrently with socket release, potentially leading to a use-after-free of the socket object. The vulnerability is caused by a race condition in the NFC LLCP connection state machine where the connection acceptance packet (CC) can be processed concurrently with socket release. This can lead to a use-after-free of the socket object. The issue is resolved by holding the lock_sock() during the state transition and list movement in nfc_llcp_recv_cc().

Official resources