A race condition in the Linux kernel NFC LLCP connection state machine allows the acceptance packet (CC) to be processed concurrently with the release of a socket. When the socket is moved from the connecting list to the active list without holding the socket lock, a concurrent release can unlink the socket and drop its references. The subsequent transition may link a freed socket back into the active list, creating a use‑after‑free in kernel memory. The flaw is identified as CWE‑364 and can cause kernel memory corruption that may lead to arbitrary code execution or privilege escalation if successfully exploited.

Any Linux kernel that includes the NFC subsystem with LLCP and has not incorporated the patch that locks the socket during the state transition is affected. This includes all distributions with a kernel version predating the commit that introduced lock_sock() in nfc_llcp_recv_cc(). The vulnerability does not affect systems that have the NFC modules disabled or that run a kernel version containing the fix.

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% suggests that exploitation attempts are currently rare. The attack requires local access to an NFC interface and a crafted NFC payload or malicious NFC device that sends a connection acceptance packet while the socket is being released. Because the vector relies on NFC hardware, systems without such hardware are not exposed. The flaw is not listed in the CISA KEV catalog at this time, but its nature means it could enable kernel memory corruption leading to local privilege escalation.