CVE-2025-71079: Linux kernel · net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f3a8a7c1aa278f2378b2f3a10500c6674dffdfda : update Linux kernel when convenient.
Data as of 10 Nov 2026, 13:18 UTC
Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- Patch
- Available – fixed in f3a8a7c1aa278f2378b2f3a10500c6674dffdfda, ee41f4f3ccf8cd6ba3732e867abbec7e6d8d12e5, e02a1c33f10a0ed3aba855ab8ae2b6c4c5be8012 +11
Exploitation evidence
Disclosed: evidence found.
CVE published 13 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in Linux kernel versions 4.15, 4.20, 5.5, 5.10.248, and 5.15.198 and later. Users and administrators should upgrade to these or later kernel versions to resolve the deadlock issue. No additional mitigation steps are required as the patch safely addresses the lock ordering problem.
Description
A deadlock vulnerability was identified and fixed in the Linux kernel's NFC subsystem. The issue arises from a lock ordering inversion between device_lock and rfkill_global_mutex during concurrent execution of nfc_unregister_device() and rfkill_fop_write(), causing a classic ABBA deadlock. The fix involves moving rfkill_unregister() and rfkill_destroy() calls outside the device_lock critical section to prevent the deadlock while ensuring safe cleanup.
References
- git.kernel.org/stable/c/2e0831e9fc46a06daa6d4d8d57a2738e343130c3 (opens in a new tab)
- git.kernel.org/stable/c/e02a1c33f10a0ed3aba855ab8ae2b6c4c5be8012 (opens in a new tab)
- git.kernel.org/stable/c/ee41f4f3ccf8cd6ba3732e867abbec7e6d8d12e5 (opens in a new tab)
- git.kernel.org/stable/c/6b93c8ab6f6cda8818983a4ae3fcf84b023037b4 (opens in a new tab)
- git.kernel.org/stable/c/8fc4632fb508432895430cd02b38086bdd649083 (opens in a new tab)
- git.kernel.org/stable/c/f3a8a7c1aa278f2378b2f3a10500c6674dffdfda (opens in a new tab)
- git.kernel.org/stable/c/1ab526d97a57e44d26fadcc0e9adeb9c0c0182f5 (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-457936.html (opens in a new tab)