Vulnerability-Lookup

CVE-2026-64011 (GCVE-0-2026-64011)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:38

Title

nfc: llcp: Fix use-after-free in llcp_sock_release()

Summary

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by checking the socket state and unlinking from the correct list.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/89ba026747019ee64…
https://git.kernel.org/stable/c/fb29f6bbe433f3dec…
https://git.kernel.org/stable/c/2dfdaaf7d933b6761…
https://git.kernel.org/stable/c/e00f50f8697724a6f…
https://git.kernel.org/stable/c/cdc17e09a636c7f93…
https://git.kernel.org/stable/c/912ebc49d4406a17f…
https://git.kernel.org/stable/c/bc421d0826dedbba3…
https://git.kernel.org/stable/c/f4268b466190dae95…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 , < 89ba026747019ee643d29407435ddc118e6ca908 (git) Affected: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 , < fb29f6bbe433f3decad227588809636c25f2a287 (git) Affected: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 , < 2dfdaaf7d933b676124aadec6698825e95f94fe9 (git) Affected: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 , < e00f50f8697724a6f1d2d35744c1332c9912dac5 (git) Affected: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 , < cdc17e09a636c7f936f771902535a7515a7608fc (git) Affected: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 , < 912ebc49d4406a17fe73e5671d674fbc2f6b2634 (git) Affected: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 , < bc421d0826dedbba37580a25405eafb599e76d42 (git) Affected: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 , < f4268b466190dae95a7585f69b4f1f8ad097632c (git) Affected: da989ee1c7702050741a551df6866cc1588f277b (git) Affected: 3.10.10 , < 3.11 (semver)	guessed
Linux	Linux	Affected: 3.11 Unaffected: 0 , < 3.11 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/llcp_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "89ba026747019ee643d29407435ddc118e6ca908",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "fb29f6bbe433f3decad227588809636c25f2a287",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "2dfdaaf7d933b676124aadec6698825e95f94fe9",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "e00f50f8697724a6f1d2d35744c1332c9912dac5",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "cdc17e09a636c7f936f771902535a7515a7608fc",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "912ebc49d4406a17fe73e5671d674fbc2f6b2634",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "bc421d0826dedbba37580a25405eafb599e76d42",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "f4268b466190dae95a7585f69b4f1f8ad097632c",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da989ee1c7702050741a551df6866cc1588f277b",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/llcp_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free in llcp_sock_release()\n\nllcp_sock_release() unconditionally unlinks the socket from the local\nsockets list.  However, if the socket is still in connecting state, it\nis on the connecting list.\n\nFix this by checking the socket state and unlinking from the correct list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered in llcp_sock_release() via the local close(2) syscall on an AF_NFC LLCP socket left in LLCP_CONNECTING after a non-blocking connect(); no remote network protocol reaches this unlink path directly.\nAC:L - An attacker fully controls the race by opening an LLCP socket, calling connect() with O_NONBLOCK, and immediately closing it; no privileged setup or uncontrollable memory-layout conditions are required beyond an active NFC DEP link.\nPR:L - SOCK_STREAM/SOCK_DGRAM LLCP sockets require no capability checks at creation or release (only SOCK_RAW needs CAP_NET_RAW), so any unprivileged local process in init_net can reach the vulnerable close() path once an NFC DEP session is up.\nUI:N - Exploitation requires only programmatic socket connect/close calls from a malicious local process; no victim user action (such as tapping, mounting, or opening a file) is needed at exploit time if an NFC link is already established.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security boundary and can lead to local privilege escalation, not a cross-boundary escape such as VM or sandbox breakout.\nC:H - This is a kernel heap use-after-free of struct nfc_llcp_sock; freed socket objects can be reallocated and read through subsequent list lookups or concurrent recv_cc()/recv_dm() processing, enabling arbitrary kernel memory disclosure.\nI:H - A use-after-free on a socket structure embedded in struct sock provides standard kernel heap-spray primitives that can be leveraged for arbitrary write and local privilege escalation via control-flow hijacking.\nA:H - The use-after-free can cause immediate kernel oops/panic during concurrent list traversal or socket teardown, and successful exploitation yields full kernel compromise with total system unavailability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:11.263Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/89ba026747019ee643d29407435ddc118e6ca908"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb29f6bbe433f3decad227588809636c25f2a287"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dfdaaf7d933b676124aadec6698825e95f94fe9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e00f50f8697724a6f1d2d35744c1332c9912dac5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdc17e09a636c7f936f771902535a7515a7608fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/912ebc49d4406a17fe73e5671d674fbc2f6b2634"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc421d0826dedbba37580a25405eafb599e76d42"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4268b466190dae95a7585f69b4f1f8ad097632c"
        }
      ],
      "title": "nfc: llcp: Fix use-after-free in llcp_sock_release()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64011",
    "datePublished": "2026-07-19T14:56:25.901Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-05T12:38:11.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64011",
      "date": "2026-09-29",
      "epss": "0.00171",
      "percentile": "0.05789"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/nfc/llcp_sock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "89ba026747019ee643d29407435ddc118e6ca908",
                    "status": "affected",
                    "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fb29f6bbe433f3decad227588809636c25f2a287",
                    "status": "affected",
                    "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2dfdaaf7d933b676124aadec6698825e95f94fe9",
                    "status": "affected",
                    "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e00f50f8697724a6f1d2d35744c1332c9912dac5",
                    "status": "affected",
                    "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cdc17e09a636c7f936f771902535a7515a7608fc",
                    "status": "affected",
                    "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "912ebc49d4406a17fe73e5671d674fbc2f6b2634",
                    "status": "affected",
                    "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bc421d0826dedbba37580a25405eafb599e76d42",
                    "status": "affected",
                    "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4268b466190dae95a7585f69b4f1f8ad097632c",
                    "status": "affected",
                    "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "da989ee1c7702050741a551df6866cc1588f277b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "affected",
                    "version": "3.10.10",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/nfc/llcp_sock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.11"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free in llcp_sock_release()\n\nllcp_sock_release() unconditionally unlinks the socket from the local\nsockets list.  However, if the socket is still in connecting state, it\nis on the connecting list.\n\nFix this by checking the socket state and unlinking from the correct list."
          }
        ],
        "id": "CVE-2026-64011",
        "lastModified": "2026-07-30T14:59:47.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:40.933",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2dfdaaf7d933b676124aadec6698825e95f94fe9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/89ba026747019ee643d29407435ddc118e6ca908"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/912ebc49d4406a17fe73e5671d674fbc2f6b2634"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bc421d0826dedbba37580a25405eafb599e76d42"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cdc17e09a636c7f936f771902535a7515a7608fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e00f50f8697724a6f1d2d35744c1332c9912dac5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f4268b466190dae95a7585f69b4f1f8ad097632c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb29f6bbe433f3decad227588809636c25f2a287"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:20:28+00:00",
      "cve": "CVE-2026-64011",
      "id": "CVE-2026-64011",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfc: llcp: Fix use-after-free in llcp_sock_release()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64011.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-24T16:32:37Z",
      "cve": "CVE-2026-64011",
      "id": "CVE-2026-64011",
      "initial_release_date": "2026-07-21T13:01:35Z",
      "product_status:first_fixed": "164",
      "product_status:known_affected": "591",
      "product_status:known_not_affected": "63",
      "product_status:recommended": "282",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64011",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64011.json",
      "version": "12"
    }
  }
}

FKIE_CVE-2026-64011

Vulnerability from fkie_nvd - Published: 2026-07-19 16:17 - Updated: 2026-07-30 14:59

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2dfdaaf7d933b676124aadec6698825e95f94fe9
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/89ba026747019ee643d29407435ddc118e6ca908
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/912ebc49d4406a17fe73e5671d674fbc2f6b2634
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bc421d0826dedbba37580a25405eafb599e76d42
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cdc17e09a636c7f936f771902535a7515a7608fc
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e00f50f8697724a6f1d2d35744c1332c9912dac5
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f4268b466190dae95a7585f69b4f1f8ad097632c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/fb29f6bbe433f3decad227588809636c25f2a287

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/llcp_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "89ba026747019ee643d29407435ddc118e6ca908",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "fb29f6bbe433f3decad227588809636c25f2a287",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "2dfdaaf7d933b676124aadec6698825e95f94fe9",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "e00f50f8697724a6f1d2d35744c1332c9912dac5",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "cdc17e09a636c7f936f771902535a7515a7608fc",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "912ebc49d4406a17fe73e5671d674fbc2f6b2634",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "bc421d0826dedbba37580a25405eafb599e76d42",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "lessThan": "f4268b466190dae95a7585f69b4f1f8ad097632c",
              "status": "affected",
              "version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "da989ee1c7702050741a551df6866cc1588f277b",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/llcp_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free in llcp_sock_release()\n\nllcp_sock_release() unconditionally unlinks the socket from the local\nsockets list.  However, if the socket is still in connecting state, it\nis on the connecting list.\n\nFix this by checking the socket state and unlinking from the correct list."
    }
  ],
  "id": "CVE-2026-64011",
  "lastModified": "2026-07-30T14:59:47.950",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-19T16:17:40.933",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2dfdaaf7d933b676124aadec6698825e95f94fe9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/89ba026747019ee643d29407435ddc118e6ca908"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/912ebc49d4406a17fe73e5671d674fbc2f6b2634"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bc421d0826dedbba37580a25405eafb599e76d42"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cdc17e09a636c7f936f771902535a7515a7608fc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e00f50f8697724a6f1d2d35744c1332c9912dac5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f4268b466190dae95a7585f69b4f1f8ad097632c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fb29f6bbe433f3decad227588809636c25f2a287"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

GHSA-QCWR-3HXC-6W36

Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-20 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix use-after-free in llcp_sock_release()

llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list.

Fix this by checking the socket state and unlinking from the correct list.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64011"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T16:17:40Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free in llcp_sock_release()\n\nllcp_sock_release() unconditionally unlinks the socket from the local\nsockets list.  However, if the socket is still in connecting state, it\nis on the connecting list.\n\nFix this by checking the socket state and unlinking from the correct list.",
  "id": "GHSA-qcwr-3hxc-6w36",
  "modified": "2026-07-20T15:31:55Z",
  "published": "2026-07-19T18:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64011"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2dfdaaf7d933b676124aadec6698825e95f94fe9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/89ba026747019ee643d29407435ddc118e6ca908"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/912ebc49d4406a17fe73e5671d674fbc2f6b2634"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bc421d0826dedbba37580a25405eafb599e76d42"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cdc17e09a636c7f936f771902535a7515a7608fc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e00f50f8697724a6f1d2d35744c1332c9912dac5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f4268b466190dae95a7585f69b4f1f8ad097632c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fb29f6bbe433f3decad227588809636c25f2a287"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2026:21910-1

Vulnerability from csaf_opensuse - Published: 2026-09-22 15:26 - Updated: 2026-09-29 08:23

Summary

Security update for the Linux Kernel

Severity

Important

Scope

885 vulnerabilities in this advisory, including CVE-2026-64011.

CVE-2026-64011

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 136 products

Open the full advisory

SUSE-SU-2026:23477-1

Vulnerability from csaf_suse - Published: 2026-09-08 12:54 - Updated: 2026-09-29 08:19

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64011.

CVE-2026-64011

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2026:23481-1

Vulnerability from csaf_suse - Published: 2026-09-08 13:00 - Updated: 2026-09-29 08:19

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64011.

CVE-2026-64011

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 11 products

Open the full advisory

SUSE-SU-2026:23528-1

Vulnerability from csaf_suse - Published: 2026-09-08 10:34 - Updated: 2026-09-29 08:19

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64011.

CVE-2026-64011

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 7 products

Open the full advisory

SUSE-SU-2026:23529-1

Vulnerability from csaf_suse - Published: 2026-09-08 11:00 - Updated: 2026-09-29 08:19

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64011.

CVE-2026-64011

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 17 products

Open the full advisory

SUSE-SU-2026:4120-1

Vulnerability from csaf_suse - Published: 2026-09-10 09:31 - Updated: 2026-09-29 08:20

Summary

Security update for the Linux Kernel

Severity

Important

Scope

662 vulnerabilities in this advisory, including CVE-2026-64011.

CVE-2026-64011

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 19 products

Open the full advisory

SUSE-SU-2026:4279-1

Vulnerability from csaf_suse - Published: 2026-09-22 08:32 - Updated: 2026-09-29 08:21

Summary

Security update for the Linux Kernel

Severity

Important

Scope

101 vulnerabilities in this advisory, including CVE-2026-64011.

CVE-2026-64011

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2026:4282-1

Vulnerability from csaf_suse - Published: 2026-09-22 08:34 - Updated: 2026-09-29 08:21

Summary

Security update for the Linux Kernel

Severity

Important

Scope

234 vulnerabilities in this advisory, including CVE-2026-64011.

CVE-2026-64011

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 164 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-64011 (GCVE-0-2026-64011)

Tags

Sightings

Nomenclature

Related by attack behaviour