CVE-2026-98580— nfc: llcp: Fix race condition in accept_queue lifecycle
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已被修复： nfc: llcp: 修复 accept_queue 生命周期中的竞态条件 在 函数中，套接字（sockets）和监听器的接受队列（accept queues）是在本地套接字的读写锁（rwlock）以及 的保护下进行遍历的。然而， 无法与 在 过程中持有的进程上下文锁 进行同步。由于 未检查 ，导致两条路径可能并发地解链（unlink）并释放同一个子套接字，从而在 中引发释放后使用（use-after-free）或对 的空指针解引用。 该同步竞态条件通过让 使用进程上下文
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-98580
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
nfc: llcp: Fix race condition in accept_queue lifecycle
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: Fix race condition in accept_queue lifecycle
In nfc_llcp_socket_release(), sockets and listener accept queues are
walked under the local sockets rwlock and bh_lock_sock(). However,
bh_lock_sock() does not synchronise against process-context lock_sock()
held by nfc_llcp_accept_dequeue() during accept(). Because
socket_release() does not check sock_owned_by_user(), both paths can
concurrently unlink and release the same child socket, resulting in
use-after-free or a NULL pointer dereference of child->parent in
nfc_llcp_accept_unlink().
Fix this synchronisation race by having nfc_llcp_socket_release() use
process-context lock_sock() instead of bh_lock_sock():
1. Pop sockets from the local sockets list under the write lock using
nfc_llcp_sock_list_pop() so lock_sock() can be acquired without
holding the rwlock.
2. Because lock_sock() can sleep, defer the final release of the
nfc_llcp_local structure to a workqueue (release_work). This avoids
a sleeping-in-atomic bug when the last local reference is dropped
from softirq context. Additionally, hold a single device reference
on local from registration until final destruction.
3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent
resurrecting a local object whose teardown has been scheduled.
4. In llcp_sock_accept(), verify that the listener socket state is still
LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if
the listener is closed concurrently.
5. When unlinking unaccepted child sockets during listener release,
unlink them from local->sockets, call sock_orphan(), and drop their
initial sk_alloc creation reference via sock_put().
6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with
a NULL check.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-98580
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-98580
请登录查看更多情报信息。
Other References for CVE-2026-98580 (8)
Same Patch Batch · Linux · 2026-10-18 · 436 CVEs total
| CVE-2026-98583 | nfc: nfcmrvl: validate helper command length before pull | |
| CVE-2026-98568 | vxlan: use one headroom snapshot for neighbour replies | |
| CVE-2026-98570 | net: ipv6: keep room for the mac header in dst_dev_overhead() | |
| CVE-2026-98571 | net: stmmac: clear stale buf->page after recycling on skb build failure | |
| CVE-2026-98572 | bpf: Fix immediate JMP JEQ/JNE on MIPS32 | |
| CVE-2026-98573 | net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() | |
| CVE-2026-98574 | net: bcmgenet: stop Tx NAPI before disabling the queues | |
| CVE-2026-98575 | nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() | |
| CVE-2026-98576 | nfc: llcp: fix slab-out-of-bounds reads when logging service names | |
| CVE-2026-98577 | nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() | |
| CVE-2026-98578 | nfc: st21nfca: validate ISO15693 inventory length | |
| CVE-2026-98579 | nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure | |
| CVE-2026-98581 | nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() | |
| CVE-2026-98582 | nfc: st21nfca: validate received frame size | |
| CVE-2026-98594 | tg3: clean up PHYLIB resources on probe failure | |
| CVE-2026-98591 | bpf: Fix bounds check for skb-backed dynptrs | |
| CVE-2026-98592 | net: spacemit: clear TX descriptor on fragment mapping failure | |
| CVE-2026-98593 | s390/debug: Fix NULL pointer dereference in debug_info_copy() | |
| CVE-2026-98590 | bpf: Fix bpf_sock context code generation | |
| CVE-2026-98595 | udp: remove a disconnected socket from the 4-tuple hash table |
Showing top 20 of 436 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2026-98580
No comments yet