nfc: nci: fix circular locking dependency in nci_close_device

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-31509
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-04-22 14:16:49 UTC
Updated2026-04-28 15:02:57 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix circular locking dependency in nci_close_device nci_close_device() flushes rx_wq and tx_wq while holding req_lock. This causes a circular locking dependency because nci_rx_work() running on rx_wq can end up taking req_lock too: nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete -> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target -> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock) Move the flush of rx_wq after req_lock has been released. This should safe (I think) because NCI_UP has already been cleared and the transport is closed, so the work will see it and return -ENETDOWN. NIPA has been hitting this running the nci selftest with a debug kernel on roughly 4% of the runs.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.000240000 probability, percentile 0.067930000 (date 2026-04-26)

Problem Types: CWE-667

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 7ed00a3edc8597fe2333f524401e2889aa1b5edf git Not specified
CNA Linux Linux affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 5eef9ebec7f5738f12cadede3545c05b34bf5ac3 git Not specified
CNA Linux Linux affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 ca54e904a071aa65ef3ad46ba42d51aaac6b73b4 git Not specified
CNA Linux Linux affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 eb435d150ca74b4d40f77f1a2266f3636ed64a79 git Not specified
CNA Linux Linux affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289 git Not specified
CNA Linux Linux affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 d89b74bf08f067b55c03d7f999ba0a0e73177eb3 git Not specified
CNA Linux Linux affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 09143c0e8f3b03517e6233aad42f45c794d8df8e git Not specified
CNA Linux Linux affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 4527025d440ce84bf56e75ce1df2e84cb8178616 git Not specified
CNA Linux Linux affected 3.2 Not specified
CNA Linux Linux unaffected 3.2 semver Not specified
CNA Linux Linux unaffected 5.10.253 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.203 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.168 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.131 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.80 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.21 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19.11 6.19.* semver Not specified
CNA Linux Linux unaffected 7.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/09143c0e8f3b03517e6233aad42f45c794d8df8e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/4527025d440ce84bf56e75ce1df2e84cb8178616 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/5eef9ebec7f5738f12cadede3545c05b34bf5ac3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/d89b74bf08f067b55c03d7f999ba0a0e73177eb3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/ca54e904a071aa65ef3ad46ba42d51aaac6b73b4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/7ed00a3edc8597fe2333f524401e2889aa1b5edf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/eb435d150ca74b4d40f77f1a2266f3636ed64a79 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report