{"id":"CVE-2025-71079","revision":"d1e3e37813cc42ffbf60db2f06f57342","records":[{"revision":"d1e3e37813cc42ffbf60db2f06f57342","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71079","aliases":[],"title":"net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write\n\nA deadlock can occur between nfc_unregister_device() and rfkill_fop_write()\ndue to lock ordering inversion between device_lock and rfkill_global_mutex.\n\nThe problematic lock order is:\n\nThread A (rfkill_fop_write):\n  rfkill_fop_write()\n    mutex_lock(&rfkill_global_mutex)\n      rfkill_set_block()\n        nfc_rfkill_set_block()\n          nfc_dev_down()\n            device_lock(&dev->dev)    <- waits for device_lock\n\nThread B (nfc_unregister_device):\n  nfc_unregister_device()\n    device_lock(&dev->dev)\n      rfkill_unregister()\n        mutex_lock(&rfkill_global_mutex)  <- waits for rfkill_global_mutex\n\nThis creates a classic ABBA deadlock scenario.\n\nFix this by moving rfkill_unregister() and rfkill_destroy() outside the\ndevice_lock critical section. Store the rfkill pointer in a local variable\nbefore releasing the lock, then call rfkill_unregister() after releasing\ndevice_lock.\n\nThis change is safe because rfkill_fop_write() holds rfkill_global_mutex\nwhile calling the rfkill callbacks, and rfkill_unregister() also acquires\nrfkill_global_mutex before cleanup. Therefore, rfkill_unregister() will\nwait for any ongoing callback to complete before proceeding, and\ndevice_del() is only called after rfkill_unregister() returns, preventing\nany use-after-free.\n\nThe similar lock ordering in nfc_register_device() (device_lock ->\nrfkill_global_mutex via rfkill_register) is safe because during\nregistration the device is not yet in rfkill_list, so no concurrent\nrfkill operations can occur on this device.","state":0,"publishedAt":"2026-01-13T15:34:44.136+00:00","modifiedAt":"2026-10-15T01:10:35.498+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/nfc/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"73a0d12114b4bc1a9def79a623264754b9df698e\",\n                            \"lessThan\": \"2e0831e9fc46a06daa6d4d8d57a2738e343130c3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a9c61c3ef187d8891225f9b932390670a43a0d3\",\n                            \"lessThan\": \"e02a1c33f10a0ed3aba855ab8ae2b6c4c5be8012\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e3b5dfcd16a3e254aab61bd1e8c417dd4503102\",\n                            \"lessThan\": \"ee41f4f3ccf8cd6ba3732e867abbec7e6d8d12e5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e3b5dfcd16a3e254aab61bd1e8c417dd4503102\",\n                            \"lessThan\": \"6b93c8ab6f6cda8818983a4ae3fcf84b023037b4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e3b5dfcd16a3e254aab61bd1e8c417dd4503102\",\n                            \"lessThan\": \"8fc4632fb508432895430cd02b38086bdd649083\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e3b5dfcd16a3e254aab61bd1e8c417dd4503102\",\n                            \"lessThan\": \"f3a8a7c1aa278f2378b2f3a10500c6674dffdfda\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e3b5dfcd16a3e254aab61bd1e8c417dd4503102\",\n                            \"lessThan\": \"1ab526d97a57e44d26fadcc0e9adeb9c0c0182f5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ef16d2d172ee56714cff37cd005b98aba08ef5a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ff169909eac9e00bf1aa0af739ba6ddfb1b1d135\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"47244ac0b65bd74cc70007d8e1bac68bd2baad19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c45cea83e13699bdfd47842e04d09dd43af4c371\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"307d2e6cebfca9d92f86c8e2c8e3dd4a8be46ba6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.82\",\n                            \"lessThan\": \"5.10.248\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.5\",\n                            \"lessThan\": \"5.15.198\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.4.293\",\n                            \"lessThan\": \"4.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.9.291\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.14.256\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.218\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.162\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/nfc/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.248\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.198\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.160\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.120\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.64\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.4\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/2e0831e9fc46a06daa6d4d8d57a2738e343130c3","https://git.kernel.org/stable/c/e02a1c33f10a0ed3aba855ab8ae2b6c4c5be8012","https://git.kernel.org/stable/c/ee41f4f3ccf8cd6ba3732e867abbec7e6d8d12e5","https://git.kernel.org/stable/c/6b93c8ab6f6cda8818983a4ae3fcf84b023037b4","https://git.kernel.org/stable/c/8fc4632fb508432895430cd02b38086bdd649083","https://git.kernel.org/stable/c/f3a8a7c1aa278f2378b2f3a10500c6674dffdfda","https://git.kernel.org/stable/c/1ab526d97a57e44d26fadcc0e9adeb9c0c0182f5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71079","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71079","identifiers":["CVE-2025-71079"]},"retained":false,"historicalAffected":[]}],"coverage":[]}