Cloudanix VulnDB

CVE-2026-98581

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how Linux handles certain short-range wireless connections lets a local user slowly drain system memory until the device stops working.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in nfc_llcp_recv_dm allows a socket to be left on the connecting_sockets list while its sk_state is set to LLCP_CLOSED without proper locking or unlinking, causing sk_del_node_init under the wrong lock during release and desynchronizing refcounts via concurrent mutations.

Why it matters to the business

Local denial-of-service on Linux systems using NFC LLCP can exhaust kernel memory and crash or destabilize devices, disrupting any operations relying on stable kernel networking for wireless communication.

How an attack unfolds

An unprivileged local process creates LLCP sockets and establishes a link; a remote peer then supplies a DM(NOBOUND) or DM(REJ) frame. The buggy recv_dm handler sets the socket closed without unlinking it, racing with llcp_sock_release which performs an incorrect unlink under sockets.lock, allowing concurrent connect operations to corrupt the hlist and leak socket objects indefinitely.

How to fix it

Update to a Linux kernel containing the equivalent fix for nfc_llcp_recv_dm that acquires lock_sock, re-validates the hashed state, and unlinks from connecting_sockets before transitioning to LLCP_CLOSED.

How to confirm the fix worked

Confirm the patch is present by inspecting nfc_llcp_recv_dm for lock_sock usage and conditional unlink before state change; reproduce with concurrent connect/release workloads under LLCP traffic to verify absence of list corruption warnings.

Typical attack path

  1. Obtain local unprivileged access on a Linux system with NFC LLCP enabled
  2. Create and bind LLCP sockets to enter the connecting state
  3. Establish an LLCP link with a remote peer
  4. Trigger DM frame reception concurrently with socket release
  5. Exploit the resulting list corruption to drive unbounded __sock_put leaks

How to detect it

Inspect kernel logs for list corruption or hlist warnings involving nfc_llcp or connecting_sockets; correlate with processes holding LLCP sockets and spikes in kernel memory consumption without corresponding object releases.

What your security team should do

  • Apply kernel updates addressing NFC LLCP race conditions as soon as available
  • Disable NFC LLCP functionality on systems where it is not required
  • Monitor kernel logs and memory usage for signs of socket or list corruption

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() nfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still linked on local->connecting_sockets: it looks the socket up with nfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and returns, without taking the socket lock and without unlinking the socket from the connecting_sockets list. llcp_sock_release() selects the list to unlink from by sk_state: a socket in LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the sockets list. Because recv_dm left the socket physically on connecting_sockets but in the LLCP_CLOSED state, release() takes the else branch and calls nfc_llcp_sock_unlink(&local->sockets, sk). That runs sk_del_node_init() while holding sockets.lock, i.e. it removes the socket from the connecting_sockets hlist under the wrong lock. A concurrent connect() linking another socket onto connecting_sockets under connecting_sockets.lock then mutates the same hlist unserialized, which corrupts the list and desyncs the sk_add_node()/sk_del_node_init() sock_hold()/__sock_put() pairing. An unprivileged local process holding LLCP sockets, with the DM supplied by the remote peer over an established LLCP link, can drive this to leak kernel sockets without bound (the mis-decrement goes through the non-freeing __sock_put() path, so the object is never released), leading to memory exhaustion / DoS. This is the same class of bug that was fixed in the sibling handler nfc_llcp_recv_cc() by commit b493ea2765cc ("nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()"); recv_dm did not receive the equivalent fix. Fix it the same way: take lock_sock(), re-check that the socket is still hashed (release() may have won the race), and for the NOBOUND/REJ case unlink it from connecting_sockets before moving it to LLCP_CLOSED. The unlink drops the connecting_sockets membership reference via sk_del_node_init(), leaving the socket unhashed, so the later nfc_llcp_sock_unlink() in llcp_sock_release() becomes a no-op and no double put occurs.

Affected packages

Ecosystem Package Introduced Fixed