CVE-2026-64011: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64011 Overview

CVE-2026-64011 is a use-after-free vulnerability in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) subsystem. The flaw resides in the llcp_sock_release() function, which unconditionally unlinks a socket from the local sockets list. When the socket remains in the connecting state, it is tracked on the connecting list instead, causing incorrect list manipulation and a subsequent use-after-free condition. A local, low-privileged attacker can trigger the condition through crafted NFC LLCP socket operations to compromise kernel memory integrity.

Critical Impact
Local attackers can exploit the use-after-free to corrupt kernel memory, potentially achieving privilege escalation to root or causing kernel denial of service.

Affected Products

Linux kernel versions containing the vulnerable llcp_sock_release() NFC LLCP implementation
Distributions shipping affected upstream kernels prior to the fix commits
Systems with the NFC LLCP kernel module loadable or loaded

Discovery Timeline

2026-07-19 - CVE-2026-64011 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64011

Vulnerability Analysis

The vulnerability affects the NFC LLCP socket lifecycle management in the Linux kernel. The llcp_sock_release() function is invoked when a socket file descriptor is closed. It unconditionally calls list removal logic against the local sockets list without verifying which list the socket actually belongs to.

LLCP sockets can exist on one of two tracking lists depending on their state. Established sockets appear on the local sockets list, while sockets still negotiating a connection remain on the connecting list. Removing a connecting-state socket from the wrong list corrupts list pointers and leaves stale references. Subsequent operations that dereference those references access freed memory.

Root Cause

The root cause is a missing socket state check in llcp_sock_release(). The release path assumes the socket is on the local sockets list, but a socket closed during the connecting phase is on the connecting list. Removing it from the wrong list creates dangling pointers that are later dereferenced, producing a use-after-free [CWE-416]. The upstream fix modifies the release routine to check the socket state and unlink from the correct list.

Attack Vector

Exploitation requires local access with the ability to create NFC LLCP sockets via the AF_NFC address family. An attacker opens an LLCP socket, initiates a connection to place it in the connecting state, and closes the socket before the connection completes. The race between connection setup and release triggers the incorrect list removal. Successful exploitation can lead to kernel memory corruption enabling privilege escalation or kernel panic.

Because NFC LLCP requires no special capability beyond standard socket creation on affected systems, the attack surface includes any local user account on hosts where the NFC subsystem is enabled. See the upstream Linux Kernel Commit 2dfdaaf for the corrective patch.

Detection Methods for CVE-2026-64011

Indicators of Compromise

Kernel oops or panic messages referencing llcp_sock_release, nfc_llcp, or list corruption warnings such as list_del corruption in dmesg output
Unexpected loading of the nfc or nfc_llcp kernel modules on systems that do not use NFC hardware
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the NFC LLCP code path on instrumented kernels

Detection Strategies

Audit installed kernel package versions against distribution advisories that reference the fix commits listed in the NVD entry
Monitor auditd for socket() calls using AF_NFC (family 39) from non-privileged processes, which is atypical on server workloads
Correlate kernel crash telemetry with process execution history to identify processes exercising the NFC LLCP interface prior to a fault

Monitoring Recommendations

Forward /var/log/kern.log and dmesg output to a centralized log platform for kernel crash analysis
Enable process and syscall telemetry to flag rare AF_NFC socket usage across the Linux fleet
Track kernel module load events for nfc and nfc_llcp and alert when they load on hosts without NFC hardware

How to Mitigate CVE-2026-64011

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD advisory and reboot affected systems to activate the fixed kernel
Blacklist the nfc and nfc_llcp modules on servers and workstations that do not require NFC functionality
Restrict local shell access to trusted users on hosts where the NFC subsystem cannot be disabled immediately

Patch Information

The Linux kernel maintainers resolved the flaw across multiple stable branches. Fix commits include Linux Kernel Commit 2dfdaaf, Linux Kernel Commit 89ba026, Linux Kernel Commit 912ebc4, Linux Kernel Commit bc421d0, Linux Kernel Commit cdc17e0, Linux Kernel Commit e00f50f, Linux Kernel Commit f4268b4, and Linux Kernel Commit fb29f6b. Consume the fix through your distribution's updated kernel package once released.

Workarounds

Prevent the vulnerable code from loading by adding blacklist nfc and blacklist nfc_llcp entries in /etc/modprobe.d/ and rebuilding the initramfs
Unload the modules at runtime with modprobe -r nfc_llcp nfc on systems where they are not in active use
Apply seccomp or LSM policies that deny socket(AF_NFC, ...) calls for untrusted processes and containers

bash

# Configuration example
# Blacklist NFC modules to eliminate the attack surface
echo 'blacklist nfc'      | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo 'blacklist nfc_llcp' | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf

# Regenerate initramfs (Debian/Ubuntu)
sudo update-initramfs -u

# Verify the modules are not loaded
lsmod | grep -E 'nfc|llcp'