CVE-2021-47068

What it actually does

Use-after-free in NFC LLCP socket handling when the same local NFC context is assigned to multiple sockets, allowing dangling reference after the first close frees the local object.

Why it matters to the business

Linux systems exposing NFC functionality risk kernel memory corruption that can lead to crashes, denial of service, or potential local privilege escalation; older kernels remain exposed until patched.

How an attack unfolds

An attacker on a system with NFC support creates two LLCP stream sockets, binds both to identical sockaddr_nfc_llcp structures, then closes them in sequence; the second close triggers use of the already-freed local pointer, enabling memory corruption.

How to fix it

Apply the upstream fix that sets llcp_sock->local to NULL after nfc_llcp_local_put in both bind and connect paths; update to a kernel containing commit 47068 or equivalent backport for the affected branch.

How to confirm the fix worked

Confirm the patch by inspecting llcp_sock_bind and llcp_sock_connect for the NULL assignment after nfc_llcp_local_put; test the provided reproducer program to ensure it no longer triggers the UAF.

Typical attack path

1. Create two AF_NFC/SOCK_STREAM/NFC_SOCKPROTO_LLCP sockets
2. Bind both sockets to the same sockaddr_nfc_llcp address
3. Close the sockets in rapid succession to trigger the dangling local reference
4. Leverage the freed object for memory corruption or information disclosure

How to detect it

Review kernel crash dumps and dmesg for references to nfc_llcp or llcp_sock after NFC socket operations; inspect audit logs for unusual sequences of AF_NFC socket creation and bind calls from untrusted processes.

What your security team should do

• Prioritize kernel updates on any system with NFC hardware or NFC socket usage enabled
• Disable NFC kernel modules (nfc, nfc_llcp) via blacklist if NFC is not required
• Monitor for kernel oops or panic reports referencing nfc_llcp_local_put or llcp_sock