In the Linux kernel, a use‑after‑free flaw (CWE-416) exists in the function llcp_sock_release() of the NFC LLCP subsystem. The routine unconditionally removes the socket from the local socket list; however, if the socket remains on the connecting list, the reference is left dangling. When the socket is freed, this dangling pointer can later be dereferenced, corrupting kernel memory (CWE-825). This can cause kernel crashes or, under certain conditions, enable further exploitation by an attacker.

All Linux kernel releases that ship the NFC LLCP subsystem and have not applied the fix are affected. The original description does not list specific kernel versions, so any build with the vulnerable code is at risk. This includes kernels from the mainline and all distributions that enable the llcp module.

The CVSS score of 7.8 signifies high severity. The EPSS score of < 1% indicates a low probability of active exploitation at this time, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is local; an attacker with user privileges must be able to create and release NFC LLCP sockets to trigger the flaw. The resulting kernel memory corruption could lead to a crash or, if an attacker can influence subsequent memory usage, to further compromise.