CVE-2026-90224

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix double completion race in nci_data_exchange_complete

nci_close_device() and nci_rx_work can both call

nci_data_exchange_complete() concurrently. After commit 4527025d440ce8

("nfc: nci: fix circular locking dependency in nci_close_device") moved

flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock),

rx_work is no longer serialized with the explicit completion call in the

close path. Both callers read the non-NULL callback pointer and invoke

rawsock_data_exchange_complete(), which calls sock_put() -- but only one

sock_hold() was taken, so the second sock_put() underflows the refcount

and frees the socket while it is still in use.

Replace the bare clear_bit(NCI_DATA_EXCHANGE) with

test_and_clear_bit() so that only the first caller proceeds to invoke

the callback.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References