This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-64011 →

DEBIAN-CVE-2026-64011

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() uncondi...

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by checking the socket state and unlinking from the correct list.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.176-1"}]}]

Debian:13 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.94-1"}]}]

Debian:14 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.12-1"}]}]

References

advisory security-tracker.debian.org