---
cve: "CVE-2026-46267"
severity: "LOW"
cvss: 3.1
epss: "12%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-06-03 18:16:28"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-14T07:07:17+02:00"
---

# CVE-2026-46267

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: shdlc: Stop timers and work before freeing context

llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc
structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state
and the skb queues. If teardown happens in parallel with a queued/running
work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm_work synchronously before purging the
queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

## Patch verfügbar (OSV)

- Kernel ≥ 5.15.202
- Kernel ≥ 6.1.165
- Kernel ≥ 6.6.128
- Kernel ≥ 6.12.75
- Kernel ≥ 6.18.14
- Kernel ≥ 6.19.4

## Referenzen

- <https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e>
- <https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a>
- <https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98>
- <https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab>
- <https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4>
- <https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced>
- <https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-46267) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_