In the Linux kernel, a use‑after‑free flaw exists in the llcp_sock_release() function of the NFC LLCP subsystem. The routine removes the socket from the local socket list regardless of its current state; if the socket is still in the connecting list, a dangling reference remains. A subsequent use of that freed pointer can corrupt kernel memory, potentially causing a crash or unstable kernel behavior.

All Linux kernel releases that ship the nfc: llcp subsystem and have not applied the fix are affected. Specific kernel versions are not provided, so any build with the vulnerable code is at risk. The affected products are the Linux kernels from all distributions offering the llcp module.

The CVSS score of 7.8 signifies high severity. The EPSS score of < 1% implies a low probability of active exploitation at this time, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is local; an attacker with user privileges must be able to create and release NFC LLCP sockets to trigger the flaw. The resulting kernel memory corruption could lead to a crash or, if an attacker can subsequently influence memory usage, to further compromise.