The flaw is a race condition in the NFC HCI SHDLC part of the Linux kernel. During deinitialization, the llc_shdlc structure is freed while its timers and state‑machine work are still active. Timer callbacks may schedule sm_work, which accesses the SHDLC state and packet queues. If teardown occurs concurrently with queued or running work, the freed object can be accessed again, leading to a use‑after‑free and potentially corrupting kernel memory or triggering a crash.

Any Linux kernel that loads the llc_shdlc (NFC HCI SHDLC) driver is affected. The issue exists in configurations that include this driver, regardless of the exact kernel version, as long as the unpatched code is present.

EPSS score is <1% and the vulnerability is not listed in CISA KEV. The CVSS score is 7.8. Kernel‑space use‑after‑free errors are high severity, and exploitation requires certain conditions. The likely attack vector requires local privileged access or a scenario where an attacker can trigger module teardown while work items are pending. If exploited, it can lead to denial of service or arbitrary code execution in kernel mode.