A race condition exists in the Linux kernel’s NFC raw socket implementation where pending transmission work can access the NCI device after the socket and device have been torn down. The kernel may dereference freed memory, leading to a use‑after‑free fault that can crash the system or allow an attacker to execute arbitrary code. The weakness is identified by CWE‑364.

The flaw is present in the Linux kernel whenever the NFC raw socket code path is compiled. No specific kernel versions are listed in the advisory, so any build that includes this code is potentially affected.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1 % suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to open a raw NFC socket locally and then terminate the owning process (e.g., by sending SIGKILL) to trigger the race. The lack of a known exploit and the local nature of the required actions reduce immediate risk, but the impact of a kernel fault warrants prompt remediation.