CVE-2026-64010 Overview
CVE-2026-64010 is a use-after-free race condition in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. The flaw resides in the nfc_llcp_recv_cc() function, which processes connection acceptance (CC) packets in the LLCP state machine. When a CC packet arrives concurrently with a socket release operation, the kernel can link a freed socket object into the live sockets list. Exploitation requires proximity via an adjacent network vector (NFC radio range) and can lead to memory corruption, kernel privilege escalation, or denial of service.
Critical Impact
An attacker within NFC range can trigger a use-after-free in the kernel, potentially achieving arbitrary code execution in kernel context or crashing affected systems.
Affected Products
- Linux Kernel (upstream)
- Distributions shipping vulnerable kernels with CONFIG_NFC and LLCP enabled
- Devices with NFC hardware exposing LLCP sockets
Discovery Timeline
- 2026-07-19 - CVE-2026-64010 published to the National Vulnerability Database (NVD)
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64010
Vulnerability Analysis
The vulnerability stems from missing socket locking during a state transition in the NFC LLCP receive path. When nfc_llcp_recv_cc() handles an inbound connection acceptance packet, it moves the associated socket from the connecting_sockets list to the sockets list. This transition previously occurred without acquiring the socket lock via lock_sock().
A concurrent execution of llcp_sock_release() can unlink the socket and drop its references while the receive path still holds a stale pointer. The receive path then relinks a freed socket into the active list, producing a classic use-after-free condition. Subsequent access to the freed memory allows kernel memory corruption.
Root Cause
The root cause is inadequate synchronization between the LLCP protocol receive handler and the socket release path. Two kernel contexts operate on the same socket object without a shared lock, violating the locking discipline already established for related handlers such as recv_hdlc() and recv_disc().
Attack Vector
An attacker within NFC radio range of a target device transmits a crafted LLCP CC packet timed to coincide with socket teardown. Because the attack requires an adjacent network position and no user interaction, exploitation is feasible against unlocked NFC-enabled devices. Successful exploitation yields kernel-level memory corruption, enabling privilege escalation or denial of service.
The fix acquires lock_sock() for the duration of the state transition and verifies the socket is still hashed before relinking. This ensures the release path cannot concurrently free the object. Refer to the upstream patch commits b493ea2, ad8a27d, and 0b45c31 for the corrected locking pattern.
Detection Methods for CVE-2026-64010
Indicators of Compromise
- Kernel oops or panic messages referencing nfc_llcp_recv_cc, llcp_sock_release, or the sockets list in NFC LLCP code paths
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads or writes in net/nfc/llcp_* source files
- Unexpected NFC socket state transitions logged during connection establishment
Detection Strategies
- Monitor kernel ring buffer (dmesg) for slab-use-after-free warnings tied to NFC subsystem symbols
- Deploy KASAN-enabled kernels in test fleets to surface race windows during fuzzing of NFC LLCP traffic
- Inventory endpoints with active NFC hardware and correlate kernel versions against patched releases
Monitoring Recommendations
- Alert on abnormal NFC daemon restarts or crashes on managed Linux endpoints and IoT gateways
- Track kernel module load events for nfc and llcp to identify systems exposing the affected code path
- Aggregate kernel crash telemetry centrally to detect distributed exploitation attempts against fleets with NFC-capable hardware
How to Mitigate CVE-2026-64010
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits b493ea2765cc, ad8a27d63cac, 0b45c31746e1, 650bdd8fdfab, b2a60f7f846f, bd08bb7443c5, dce85215a6c7, and ee2d1a8a1833
- Update to the latest stable kernel release provided by your Linux distribution vendor
- Disable NFC on devices that do not require it until patched kernels are deployed
Patch Information
The fix holds lock_sock() during the state transition in nfc_llcp_recv_cc() and checks that the socket is still hashed before relinking it. This aligns LLCP receive handling with the locking pattern used by recv_hdlc() and recv_disc(). Consult the Linux Kernel Commit b493ea2 and companion backports for stable branches.
Workarounds
- Unload the nfc and nfc_llcp kernel modules on systems that do not use NFC
- Blacklist NFC modules via /etc/modprobe.d/ to prevent automatic loading at boot
- Restrict physical access to NFC-capable devices to reduce the adjacent-network attack surface
# Configuration example: disable NFC modules until patched
echo 'blacklist nfc' | sudo tee /etc/modprobe.d/disable-nfc.conf
echo 'blacklist nfc_llcp' | sudo tee -a /etc/modprobe.d/disable-nfc.conf
sudo modprobe -r nfc_llcp nfc 2>/dev/null
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
