Cloudanix VulnDB

CVE-2026-98580

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the part of the Linux kernel that handles near-field communication connections can let one operation interfere with another, potentially crashing the system or allowing an attacker to take control.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition between nfc_llcp_socket_release() and nfc_llcp_accept_dequeue() allows concurrent unlinking and release of the same child socket, producing use-after-free or NULL pointer dereference of child->parent.

Why it matters to the business

Systems relying on NFC LLCP may experience kernel crashes or memory corruption that interrupt operations and create exploitable conditions on affected devices.

How an attack unfolds

An attacker with local access crafts concurrent socket accept and release operations on NFC LLCP listener sockets so that the missing synchronization between bh_lock_sock and lock_sock paths lets two threads free the same child socket structure.

How to fix it

Apply the upstream fix that replaces bh_lock_sock with process-context lock_sock, adds kref_get_unless_zero guards, defers local release to a workqueue, and makes accept_unlink idempotent; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the patched kernel contains the described changes to nfc_llcp_socket_release, nfc_llcp_accept_unlink, and llcp_sock_accept; run concurrency stress tests exercising LLCP accept/release paths and verify absence of crashes or KASAN reports.

Typical attack path

  1. Create and bind an NFC LLCP listener socket
  2. Trigger accept() from process context while simultaneously releasing the listener from another context
  3. Force the race window by timing socket operations to hit the unprotected child unlink path
  4. Trigger use-after-free or NULL dereference during nfc_llcp_accept_unlink()

How to detect it

Inspect kernel logs for oops, BUG, or KASAN reports referencing nfc_llcp_accept_unlink, nfc_llcp_socket_release, or child->parent; correlate with processes performing rapid NFC LLCP socket creation and teardown.

What your security team should do

  • Prioritize kernel update on any system exposing NFC LLCP interfaces
  • Disable NFC LLCP functionality where not required until patched
  • Monitor for kernel oops or KASAN reports involving nfc_llcp_accept_unlink

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in accept_queue lifecycle In nfc_llcp_socket_release(), sockets and listener accept queues are walked under the local sockets rwlock and bh_lock_sock(). However, bh_lock_sock() does not synchronise against process-context lock_sock() held by nfc_llcp_accept_dequeue() during accept(). Because socket_release() does not check sock_owned_by_user(), both paths can concurrently unlink and release the same child socket, resulting in use-after-free or a NULL pointer dereference of child->parent in nfc_llcp_accept_unlink(). Fix this synchronisation race by having nfc_llcp_socket_release() use process-context lock_sock() instead of bh_lock_sock(): 1. Pop sockets from the local sockets list under the write lock using nfc_llcp_sock_list_pop() so lock_sock() can be acquired without holding the rwlock. 2. Because lock_sock() can sleep, defer the final release of the nfc_llcp_local structure to a workqueue (release_work). This avoids a sleeping-in-atomic bug when the last local reference is dropped from softirq context. Additionally, hold a single device reference on local from registration until final destruction. 3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent resurrecting a local object whose teardown has been scheduled. 4. In llcp_sock_accept(), verify that the listener socket state is still LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if the listener is closed concurrently. 5. When unlinking unaccepted child sockets during listener release, unlink them from local->sockets, call sock_orphan(), and drop their initial sk_alloc creation reference via sock_put(). 6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with a NULL check.

Affected packages

Ecosystem Package Introduced Fixed