CVE-2026-98580 - Vulnerability Details

- nfc: llcp: Fix race condition in accept_queue lifecycle

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix race condition in accept_queue lifecycle

In nfc_llcp_socket_release(), sockets and listener accept queues are
walked under the local sockets rwlock and bh_lock_sock(). However,
bh_lock_sock() does not synchronise against process-context lock_sock()
held by nfc_llcp_accept_dequeue() during accept(). Because
socket_release() does not check sock_owned_by_user(), both paths can
concurrently unlink and release the same child socket, resulting in
use-after-free or a NULL pointer dereference of child->parent in
nfc_llcp_accept_unlink().

Fix this synchronisation race by having nfc_llcp_socket_release() use
process-context lock_sock() instead of bh_lock_sock():

1. Pop sockets from the local sockets list under the write lock using
nfc_llcp_sock_list_pop() so lock_sock() can be acquired without
holding the rwlock.

2. Because lock_sock() can sleep, defer the final release of the
nfc_llcp_local structure to a workqueue (release_work). This avoids
a sleeping-in-atomic bug when the last local reference is dropped
from softirq context. Additionally, hold a single device reference
on local from registration until final destruction.

3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent
resurrecting a local object whose teardown has been scheduled.

4. In llcp_sock_accept(), verify that the listener socket state is still
LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if
the listener is closed concurrently.

5. When unlinking unaccepted child sockets during listener release,
unlink them from local->sockets, call sock_orphan(), and drop their
initial sk_alloc creation reference via sock_put().

6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with
a NULL check.

Published: 2026-10-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a race condition between the accept and release paths in the Linux NFC LLCP subsystem. The lack of synchronization between the local socket read/write lock and lock_sock() during accept() allows the same child socket to be unlinked and released simultaneously. This produces a use‑after‑free or a NULL pointer dereference of the child’s parent field, leading to kernel memory corruption that may crash the kernel or provide local privilege escalation. The weakness corresponds to the race condition CWE-825.

Affected Systems

Affected systems are all Linux kernel builds that include the NFC LLCP driver before the commit that applies the patch. No specific kernel version range is published in the CVE record, so any kernel that contains the pre‑patch implementation of nfc_llcp is at risk.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 percent suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The CVE description does not specify an attack vector, but it is inferred that exploitation would require local access to the NFC LLCP subsystem and the ability to create or manipulate NFC LLCP sockets. A successful exploit could result in a kernel crash or local privilege escalation, but remote exploitation is not supported by the available information.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`50b78b2a6500d0e97c204c1b6c51df8c17358bbe`	affected	< 54adcabb0f1deef1bdae5fc64779ed6d442721c9
`50b78b2a6500d0e97c204c1b6c51df8c17358bbe`	affected	< 7c938aad5108382c6ad7453c4b5ee8ae3f3252ed
`50b78b2a6500d0e97c204c1b6c51df8c17358bbe`	affected	< d2093a0981138876212bc5f473bdbfba0786e064
`50b78b2a6500d0e97c204c1b6c51df8c17358bbe`	affected	< 41256821762a7114906b178826d17098e2fa5992
`50b78b2a6500d0e97c204c1b6c51df8c17358bbe`	affected	< 53867f6acb1af7f12d6485fa8a2819318f89083b
`50b78b2a6500d0e97c204c1b6c51df8c17358bbe`	affected	< da8a07757383614a8380a0f7dd54749d2687b82e
`50b78b2a6500d0e97c204c1b6c51df8c17358bbe`	affected	< d5e1c92d09caed19f2988739695ce611a86ba6f8
`50b78b2a6500d0e97c204c1b6c51df8c17358bbe`	affected	< c3eef2f988a3db9690369d7cef9a3344dd9788d3

Linux

affected

Version	Status	Constraints
`3.7`	affected	—
`0`	unaffected	< 3.7
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[50b78b2a6500d0e97c204c1b6c51df8c17358bbe,54adcabb0f1deef1bdae5fc64779ed6d442721c9)`	affected	code_commit	—
`[50b78b2a6500d0e97c204c1b6c51df8c17358bbe,7c938aad5108382c6ad7453c4b5ee8ae3f3252ed)`	affected	code_commit	—
`[50b78b2a6500d0e97c204c1b6c51df8c17358bbe,d2093a0981138876212bc5f473bdbfba0786e064)`	affected	code_commit	—
`[50b78b2a6500d0e97c204c1b6c51df8c17358bbe,41256821762a7114906b178826d17098e2fa5992)`	affected	code_commit	—
`[50b78b2a6500d0e97c204c1b6c51df8c17358bbe,53867f6acb1af7f12d6485fa8a2819318f89083b)`	affected	code_commit	—
`[50b78b2a6500d0e97c204c1b6c51df8c17358bbe,da8a07757383614a8380a0f7dd54749d2687b82e)`	affected	code_commit	—
`[50b78b2a6500d0e97c204c1b6c51df8c17358bbe,d5e1c92d09caed19f2988739695ce611a86ba6f8)`	affected	code_commit	—
`[50b78b2a6500d0e97c204c1b6c51df8c17358bbe,c3eef2f988a3db9690369d7cef9a3344dd9788d3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.7`	affected	generic	—
`[0,3.7)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that contains the CVE-2026-98580 fix.
Unload or disable the nfc_llcp module to prevent the race condition from being triggered.
Restrict local user access to NFC devices, e.g., remove users from the nfc group or set the /dev/nfc device permissions to 0600 so only root can open it.

Generated by OpenCVE AI on October 22, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98580.mbox
https://git.kernel.org/stable/c/41256821762a7114906b178826d17098e2fa5992
https://git.kernel.org/stable/c/53867f6acb1af7f12d6485fa8a2819318f89083b
https://git.kernel.org/stable/c/54adcabb0f1deef1bdae5fc64779ed6d442721c9
https://git.kernel.org/stable/c/7c938aad5108382c6ad7453c4b5ee8ae3f3252ed
https://git.kernel.org/stable/c/c3eef2f988a3db9690369d7cef9a3344dd9788d3
https://git.kernel.org/stable/c/d2093a0981138876212bc5f473bdbfba0786e064
https://git.kernel.org/stable/c/d5e1c92d09caed19f2988739695ce611a86ba6f8
https://git.kernel.org/stable/c/da8a07757383614a8380a0f7dd54749d2687b82e
https://nvd.nist.gov/vuln/detail/CVE-2026-98580
https://www.cve.org/CVERecord?id=CVE-2026-98580

History

Tue, 20 Oct 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416 CWE-476

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98580.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98580 https://www.cve.org/CVERecord?id=CVE-2026-98580
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416 CWE-476

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in accept_queue lifecycle In nfc_llcp_socket_release(), sockets and listener accept queues are walked under the local sockets rwlock and bh_lock_sock(). However, bh_lock_sock() does not synchronise against process-context lock_sock() held by nfc_llcp_accept_dequeue() during accept(). Because socket_release() does not check sock_owned_by_user(), both paths can concurrently unlink and release the same child socket, resulting in use-after-free or a NULL pointer dereference of child->parent in nfc_llcp_accept_unlink(). Fix this synchronisation race by having nfc_llcp_socket_release() use process-context lock_sock() instead of bh_lock_sock(): 1. Pop sockets from the local sockets list under the write lock using nfc_llcp_sock_list_pop() so lock_sock() can be acquired without holding the rwlock. 2. Because lock_sock() can sleep, defer the final release of the nfc_llcp_local structure to a workqueue (release_work). This avoids a sleeping-in-atomic bug when the last local reference is dropped from softirq context. Additionally, hold a single device reference on local from registration until final destruction. 3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent resurrecting a local object whose teardown has been scheduled. 4. In llcp_sock_accept(), verify that the listener socket state is still LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if the listener is closed concurrently. 5. When unlinking unaccepted child sockets during listener release, unlink them from local->sockets, call sock_orphan(), and drop their initial sk_alloc creation reference via sock_put(). 6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with a NULL check.
Title		nfc: llcp: Fix race condition in accept_queue lifecycle
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/41256821762a7114906b178826d17098e2fa5992 https://git.kernel.org/stable/c/53867f6acb1af7f12d6485fa8a2819318f89083b https://git.kernel.org/stable/c/54adcabb0f1deef1bdae5fc64779ed6d442721c9 https://git.kernel.org/stable/c/7c938aad5108382c6ad7453c4b5ee8ae3f3252ed https://git.kernel.org/stable/c/c3eef2f988a3db9690369d7cef9a3344dd9788d3 https://git.kernel.org/stable/c/d2093a0981138876212bc5f473bdbfba0786e064 https://git.kernel.org/stable/c/d5e1c92d09caed19f2988739695ce611a86ba6f8 https://git.kernel.org/stable/c/da8a07757383614a8380a0f7dd54749d2687b82e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:53.819Z

Updated: 2026-10-19T09:22:05.887Z

Reserved: 2026-09-25T10:25:14.358Z

Link: CVE-2026-98580

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:10.483

Modified: 2026-10-19T10:19:18.640

Link: CVE-2026-98580

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98580 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T22:30:13Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object