Linux Kernel NFC NCI Circular Locking Dep (CVE-2026-31509)
CVE-2026-31509 Published on April 22, 2026
nfc: nci: fix circular locking dependency in nci_close_device
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix circular locking dependency in nci_close_device
nci_close_device() flushes rx_wq and tx_wq while holding req_lock.
This causes a circular locking dependency because nci_rx_work()
running on rx_wq can end up taking req_lock too:
nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
-> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
-> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)
Move the flush of rx_wq after req_lock has been released.
This should safe (I think) because NCI_UP has already been cleared
and the transport is closed, so the work will see it and return
-ENETDOWN.
NIPA has been hitting this running the nci selftest with a debug
kernel on roughly 4% of the runs.
Products Associated with CVE-2026-31509
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 6a2968aaf50c7a22fced77a5e24aa636281efca8 and below 7ed00a3edc8597fe2333f524401e2889aa1b5edf is affected.
- Version 6a2968aaf50c7a22fced77a5e24aa636281efca8 and below 5eef9ebec7f5738f12cadede3545c05b34bf5ac3 is affected.
- Version 6a2968aaf50c7a22fced77a5e24aa636281efca8 and below ca54e904a071aa65ef3ad46ba42d51aaac6b73b4 is affected.
- Version 6a2968aaf50c7a22fced77a5e24aa636281efca8 and below eb435d150ca74b4d40f77f1a2266f3636ed64a79 is affected.
- Version 6a2968aaf50c7a22fced77a5e24aa636281efca8 and below 1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289 is affected.
- Version 6a2968aaf50c7a22fced77a5e24aa636281efca8 and below d89b74bf08f067b55c03d7f999ba0a0e73177eb3 is affected.
- Version 6a2968aaf50c7a22fced77a5e24aa636281efca8 and below 09143c0e8f3b03517e6233aad42f45c794d8df8e is affected.
- Version 6a2968aaf50c7a22fced77a5e24aa636281efca8 and below 4527025d440ce84bf56e75ce1df2e84cb8178616 is affected.
- Version 3.2 is affected.
- Before 3.2 is unaffected.
- Version 5.10.253, <= 5.10.* is unaffected.
- Version 5.15.203, <= 5.15.* is unaffected.
- Version 6.1.168, <= 6.1.* is unaffected.
- Version 6.6.131, <= 6.6.* is unaffected.
- Version 6.12.80, <= 6.12.* is unaffected.
- Version 6.18.21, <= 6.18.* is unaffected.
- Version 6.19.11, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.