From c895394586eeb761a87007e523c5454f9bd9750c Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Wed, 29 Apr 2026 21:40:41 +0800 Subject: [PATCH] nfc: llcp: Fix use-after-free in llcp_sock_release() ANBZ: #40672 commit 89ba026747019ee643d29407435ddc118e6ca908 stable. commit f4268b466190dae95a7585f69b4f1f8ad097632c upstream. llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by checking the socket state and unlinking from the correct list. Fixes: b4011239a08e ("NFC: llcp: Fix non blocking sockets connections") Signed-off-by: Lee Jones Link: https://patch.msgid.link/20260429134115.3558604-1-lee@kernel.org Signed-off-by: David Heidelberg Signed-off-by: Sasha Levin Fixes: CVE-2026-64011 Assisted-by: PatchPilot Signed-off-by: Xuan Zhuo --- net/nfc/llcp_sock.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c index 6e1fba208493..54af85d939c6 100644 --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -640,6 +640,8 @@ static int llcp_sock_release(struct socket *sock) if (sock->type == SOCK_RAW) nfc_llcp_sock_unlink(&local->raw_sockets, sk); + else if (sk->sk_state == LLCP_CONNECTING) + nfc_llcp_sock_unlink(&local->connecting_sockets, sk); else nfc_llcp_sock_unlink(&local->sockets, sk); -- Gitee