CVE-2026-98580

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix race condition in accept_queue lifecycle

In nfc_llcp_socket_release(), sockets and listener accept queues are

walked under the local sockets rwlock and bh_lock_sock(). However,

bh_lock_sock() does not synchronise against process-context lock_sock()

held by nfc_llcp_accept_dequeue() during accept(). Because

socket_release() does not check sock_owned_by_user(), both paths can

concurrently unlink and release the same child socket, resulting in

use-after-free or a NULL pointer dereference of child->parent in

nfc_llcp_accept_unlink().

Fix this synchronisation race by having nfc_llcp_socket_release() use

process-context lock_sock() instead of bh_lock_sock():

1. Pop sockets from the local sockets list under the write lock using

nfc_llcp_sock_list_pop() so lock_sock() can be acquired without

holding the rwlock.

2. Because lock_sock() can sleep, defer the final release of the

nfc_llcp_local struct

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References