nfc: nci: fix circular locking dependency in nci_close_devic… (CVE-2026-31509)

Résumé

nfc: nci: fix circular locking dependency in nci_close_device

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix circular locking dependency in nci_close_device

nci_close_device() flushes rx_wq and tx_wq while holding req_lock.
This causes a circular locking dependency because nci_rx_work()
running on rx_wq can end up taking req_lock too:

nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
-> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
-> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)

Move the flush of rx_wq after req_lock has been released.
This should safe (I think) because NCI_UP has already been cleared
and the transport is closed, so the work will see it and return
-ENETDOWN.

NIPA has been hitting this running the nci selftest with a debug
kernel on roughly 4% of the runs.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"5.10.253"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.203"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.168"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.131"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.80"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.21"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.11"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

BellSoft Alpaquita BELL-CVE-2026-31509 linux-lts Corrigé dans: 6.1.168-r0
Debian DEBIAN-CVE-2026-31509 linux Corrigé dans: 5.10.257-1
Ubuntu UBUNTU-CVE-2026-31509 linux

Résumé

Description d'origine

Paquets affectés

État des correctifs par distribution

Références