Bug 2484467 (CVE-2026-46267)

Summary:	CVE-2026-46267 kernel: nfc: hci: shdlc: Stop timers and work before freeing context
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Near Field Communication (NFC) Host Controller Interface (HCI) Synchronous High-level Data Link Control (SHDLC) subsystem. This vulnerability arises because timers and work items can remain active and access freed SHDLC state and data queues during the deinitialization process (`llc_shdlc_deinit()`). This can lead to a Use-After-Free (UAF) condition and other shutdown race issues, potentially causing system instability or crashes.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-03 18:02:52 UTC

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: shdlc: Stop timers and work before freeing context

llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc
structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state
and the skb queues. If teardown happens in parallel with a queued/running
work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm_work synchronously before purging the
queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Comment 1 Keith Grant 2026-06-03 19:16:34 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026060338-CVE-2026-46267-5845@gregkh/T