{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2025-71079", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-71079", "idYear": 2025, "status": "PUBLISHED", "publishedAt": "2026-01-13T15:34:44.136Z", "updatedAt": "2026-10-15T01:10:35.498Z", "importedAt": "2026-10-24T01:57:44.935Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write\n\nA deadlock can occur between nfc_unregister_device() and rfkill_fop_write()\ndue to lock ordering inversion between device_lock and rfkill_global_mutex.\n\nThe problematic lock order is:\n\nThread A (rfkill_fop_write):\n rfkill_fop_write()\n mutex_lock(&rfkill_global_mutex)\n rfkill_set_block()\n nfc_rfkill_set_block()\n nfc_dev_down()\n device_lock(&dev->dev) <- waits for device_lock\n\nThread B (nfc_unregister_device):\n nfc_unregister_device()\n device_lock(&dev->dev)\n rfkill_unregister()\n mutex_lock(&rfkill_global_mutex) <- waits for rfkill_global_mutex\n\nThis creates a classic ABBA deadlock scenario.\n\nFix this by moving rfkill_unregister() and rfkill_destroy() outside the\ndevice_lock critical section. Store the rfkill pointer in a local variable\nbefore releasing the lock, then call rfkill_unregister() after releasing\ndevice_lock.\n\nThis change is safe because rfkill_fop_write() holds rfkill_global_mutex\nwhile calling the rfkill callbacks, and rfkill_unregister() also acquires\nrfkill_global_mutex before cleanup. Therefore, rfkill_unregister() will\nwait for any ongoing callback to complete before proceeding, and\ndevice_del() is only called after rfkill_unregister() returns, preventing\nany use-after-free.\n\nThe similar lock ordering in nfc_register_device() (device_lock ->\nrfkill_global_mutex via rfkill_register) is safe because during\nregistration the device is not yet in rfkill_list, so no concurrent\nrfkill operations can occur on this device.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "73a0d12114b4bc1a9def79a623264754b9df698e", "status": "affected", "versionType": "git", "lessThan": "2e0831e9fc46a06daa6d4d8d57a2738e343130c3" }, { "version": "8a9c61c3ef187d8891225f9b932390670a43a0d3", "status": "affected", "versionType": "git", "lessThan": "e02a1c33f10a0ed3aba855ab8ae2b6c4c5be8012" }, { "version": "3e3b5dfcd16a3e254aab61bd1e8c417dd4503102", "status": "affected", "versionType": "git", "lessThan": "ee41f4f3ccf8cd6ba3732e867abbec7e6d8d12e5" }, { "version": "3e3b5dfcd16a3e254aab61bd1e8c417dd4503102", "status": "affected", "versionType": "git", "lessThan": "6b93c8ab6f6cda8818983a4ae3fcf84b023037b4" }, { "version": "3e3b5dfcd16a3e254aab61bd1e8c417dd4503102", "status": "affected", "versionType": "git", "lessThan": "8fc4632fb508432895430cd02b38086bdd649083" }, { "version": "3e3b5dfcd16a3e254aab61bd1e8c417dd4503102", "status": "affected", "versionType": "git", "lessThan": "f3a8a7c1aa278f2378b2f3a10500c6674dffdfda" }, { "version": "3e3b5dfcd16a3e254aab61bd1e8c417dd4503102", "status": "affected", "versionType": "git", "lessThan": "1ab526d97a57e44d26fadcc0e9adeb9c0c0182f5" }, { "version": "5ef16d2d172ee56714cff37cd005b98aba08ef5a", "status": "affected", "versionType": "git" }, { "version": "ff169909eac9e00bf1aa0af739ba6ddfb1b1d135", "status": "affected", "versionType": "git" }, { "version": "47244ac0b65bd74cc70007d8e1bac68bd2baad19", "status": "affected", "versionType": "git" }, { "version": "c45cea83e13699bdfd47842e04d09dd43af4c371", "status": "affected", "versionType": "git" }, { "version": "307d2e6cebfca9d92f86c8e2c8e3dd4a8be46ba6", "status": "affected", "versionType": "git" }, { "version": "5.10.82", "status": "affected", "versionType": "semver", "lessThan": "5.10.248" }, { "version": "5.15.5", "status": "affected", "versionType": "semver", "lessThan": "5.15.198" }, { "version": "4.4.293", "status": "affected", "versionType": "semver", "lessThan": "4.5" }, { "version": "4.9.291", "status": "affected", "versionType": "semver", "lessThan": "4.10" }, { "version": "4.14.256", "status": "affected", "versionType": "semver", "lessThan": "4.15" }, { "version": "4.19.218", "status": "affected", "versionType": "semver", "lessThan": "4.20" }, { "version": "5.4.162", "status": "affected", "versionType": "semver", "lessThan": "5.5" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "5.16", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "5.16" }, { "version": "5.10.248", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.198", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.160", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.120", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.64", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.4", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "6.19", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }