CVE-2026-98581

Received Received - Intake

Use-After-Free in Linux Kernel NFC LLCP Module

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() nfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still linked on local->connecting_sockets: it looks the socket up with nfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and returns, without taking the socket lock and without unlinking the socket from the connecting_sockets list. llcp_sock_release() selects the list to unlink from by sk_state: a socket in LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the sockets list. Because recv_dm left the socket physically on connecting_sockets but in the LLCP_CLOSED state, release() takes the else branch and calls nfc_llcp_sock_unlink(&local->sockets, sk). That runs sk_del_node_init() while holding sockets.lock, i.e. it removes the socket from the connecting_sockets hlist under the wrong lock. A concurrent connect() linking another socket onto connecting_sockets under connecting_sockets.lock then mutates the same hlist unserialized, which corrupts the list and desyncs the sk_add_node()/sk_del_node_init() sock_hold()/__sock_put() pairing. An unprivileged local process holding LLCP sockets, with the DM supplied by the remote peer over an established LLCP link, can drive this to leak kernel sockets without bound (the mis-decrement goes through the non-freeing __sock_put() path, so the object is never released), leading to memory exhaustion / DoS. This is the same class of bug that was fixed in the sibling handler nfc_llcp_recv_cc() by commit b493ea2765cc ("nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()"); recv_dm did not receive the equivalent fix. Fix it the same way: take lock_sock(), re-check that the socket is still hashed (release() may have won the race), and for the NOBOUND/REJ case unlink it from connecting_sockets before moving it to LLCP_CLOSED. The unlink drops the connecting_sockets membership reference via sk_del_node_init(), leaving the socket unhashed, so the later nfc_llcp_sock_unlink() in llcp_sock_release() becomes a no-op and no double put occurs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98581

EUVD

EUVD-2026-103626

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	a69f32af86e389dd232b1bb2269e202c1bfcc60f
Linux	Linux	a69f32af86e389dd232b1bb2269e202c1bfcc60f
Linux	Linux	a69f32af86e389dd232b1bb2269e202c1bfcc60f
Linux	Linux	a69f32af86e389dd232b1bb2269e202c1bfcc60f
Linux	Linux	a69f32af86e389dd232b1bb2269e202c1bfcc60f
Linux	Linux	a69f32af86e389dd232b1bb2269e202c1bfcc60f
Linux	Linux	a69f32af86e389dd232b1bb2269e202c1bfcc60f
Linux	Linux	a69f32af86e389dd232b1bb2269e202c1bfcc60f
Linux	Linux	3.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a flaw in the NFC LLCP (Near Field Communication Logical Link Control Protocol) module allows an unprivileged local attacker to cause memory exhaustion and denial of service. The issue occurs when handling DM (Disconnect Mode) packets for sockets still in a connecting state. The socket is incorrectly moved to a closed state without proper locking or list management, leading to list corruption and reference count desynchronization.

Detection Guidance

This vulnerability affects the Linux kernel's NFC LLCP (Near Field Communication Logical Link Control Protocol) implementation. Detection requires checking if your system is running a vulnerable kernel version and inspecting NFC-related processes for abnormal behavior. Commands like 'uname -a' to check kernel version and 'dmesg | grep -i nfc' to check for NFC-related errors may help. However, specific detection commands are not provided in the context.

Impact Analysis

An attacker with local access could exploit this to exhaust system memory by leaking kernel sockets, causing the system to become unresponsive or crash. This could disrupt services, applications, or the entire operating system, especially on systems with many NFC connections or limited memory.

Compliance Impact

This vulnerability is a local denial-of-service issue in the Linux kernel's NFC LLCP subsystem. It does not directly involve data exposure or unauthorized access, so it is unlikely to directly impact compliance with GDPR or HIPAA. However, a successful exploit could lead to system instability or resource exhaustion, which may indirectly affect availability requirements under these regulations.

Mitigation Strategies

Apply the kernel patch that fixes this issue. Update your Linux kernel to a version that includes the fix for nfc_llcp_recv_dm(). If immediate patching is not possible, consider disabling NFC functionality temporarily by unloading the NFC kernel modules (e.g., 'modprobe -r nfc') until the patch is applied.

Hi! I’m here to help you understand CVE-2026-98581. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70