CVE-2026-31509

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix circular locking dependency in nciclosedevice

nciclosedevice() flushes rxwq and txwq while holding reqlock. This causes a circular locking dependency because ncirxwork() running on rxwq can end up taking req_lock too:

ncirxwork -> ncirxdatapacket -> ncidataexchangecomplete -> _skdestruct -> rawsockdestruct -> nfcdeactivatetarget -> ncideactivatetarget -> ncirequest -> mutexlock(&ndev->reqlock)

Move the flush of rxwq after reqlock has been released. This should safe (I think) because NCI_UP has already been cleared and the transport is closed, so the work will see it and return -ENETDOWN.

NIPA has been hitting this running the nci selftest with a debug kernel on roughly 4% of the runs.