CVE-2026-31629
Linux Kernel 3.3 – 6.6.136
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-31629 is a high-severity Improper Locking (CWE-667) vulnerability in Linux Linux Kernel. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31629 is a use-after-free vulnerability in the Linux kernel's NFC LLCP subsystem. Specifically, in the functions nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code calls release_sock() and nfc_llcp_sock_put() but omits a return statement, allowing execution to continue. This results in a double invocation of release_sock() and nfc_llcp_sock_put(), causing a reference count underflow and subsequent use-after-free. The issue affects Linux kernel versions prior to the application of the relevant stable patches.
An adjacent attacker with low complexity and no privileges or user interaction required can exploit this vulnerability over the NFC interface. Successful exploitation leads to high-impact confidentiality, integrity, and availability consequences (CVSS 3.1 score of 8.8: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), potentially enabling arbitrary code execution, data corruption, or system crashes via the use-after-free.
Mitigation involves applying the upstream kernel patches referenced in the stable repository commits: 0eb1263a3b8c36418c9ba295c9ab3abed664edbf, 2b5dd4632966c39da6ba74dbc8689b309065e82c, 796e0cac058252d0ad34ebe288e6f7979b5fc9b2, 8977fad2b3c6eefd414131168d597c5d1d5e1abf, and aba4712e8f0381cd5d196534ce2ad082626a5ab6. These commits add the missing return statements after the LLCP_CLOSED checks to prevent fall-through and double releases. Security practitioners should ensure NFC LLCP functionality is disabled if not required, pending patch deployment.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25522
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED checks In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly calls release_sock() and nfc_llcp_sock_put() but fails to return. Execution…
more
falls through to the remainder of the function, which calls release_sock() and nfc_llcp_sock_put() again. This results in a double release_sock() and a refcount underflow via double nfc_llcp_sock_put(), leading to a use-after-free. Add the missing return statements after the LLCP_CLOSED branches in both functions to prevent the fall-through.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes concurrency and locking requirements that reduce improper locking defects.
A.8.26 only requires that security requirements (including resilience against attacks such as buffer overflows or SQL injection) be identified and specified during development or acquisition; it does not itself enforce, implement, or prevent improper locking from being present or exploitable in the resulting application.
Secure architecture principles address thread-safety and resource synchronization.
Secure coding standards directly prohibit missing or incorrect lock usage.
Security testing can detect race conditions and locking errors before release.
Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-667, a class-level weakness, and none of its children carries one either.