A race condition exists in the Linux kernel’s NFC raw socket implementation where pending transmission work can access the NCI device after the socket and device have been torn down. The kernel may dereference freed memory, leading to a use‑after‑free fault that can crash the system or allow an attacker to execute arbitrary code. The weakness is identified by CWE‑364.

Specifically, the vulnerability exists in the Linux kernel versions 3.1, as well as 7.0 release candidates rc1 through rc7. The flaw is present in any kernel build that includes the NFC raw socket implementation. Therefore systems running any of those kernel versions, or kernels derived from them that still compile the NFC raw socket code, are potentially affected.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1 % suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to open a raw NFC socket locally and then terminate the owning process (e.g., by sending SIGKILL) to trigger the race. The lack of a known exploit and the local nature of the required actions reduce immediate risk, but the impact of a kernel fault warrants prompt remediation.