{"id":"CVE-2026-98580","kind":"vulnerability","aliases":["CVE-2026-98580"],"related":[],"title":"Linux kernel NFC LLCP: race in accept queue can cause use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix race condition in accept_queue lifecycle\n\nIn nfc_llcp_socket_release(), sockets and listener accept queues are\nwalked under the local sockets rwlock and bh_lock_sock().  However,\nbh_lock_sock() does not synchronise against process-context lock_sock()\nheld by nfc_llcp_accept_dequeue() during accept().  Because\nsocket_release() does not check sock_owned_by_user(), both paths can\nconcurrently unlink and release the same child socket, resulting in\nuse-after-free or a NULL pointer dereference of child->parent in\nnfc_llcp_accept_unlink().\n\nFix this synchronisation race by having nfc_llcp_socket_release() use\nprocess-context lock_sock() instead of bh_lock_sock():\n\n1. Pop sockets from the local sockets list under the write lock using\n   nfc_llcp_sock_list_pop() so lock_sock() can be acquired without\n   holding the rwlock.\n\n2. Because lock_sock() can sleep, defer the final release of the\n   nfc_llcp_local structure to a workqueue (release_work).  This avoids\n   a sleeping-in-atomic bug when the last local reference is dropped\n   from softirq context.  Additionally, hold a single device reference\n   on local from registration until final destruction.\n\n3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent\n   resurrecting a local object whose teardown has been scheduled.\n\n4. In llcp_sock_accept(), verify that the listener socket state is still\n   LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if\n   the listener is closed concurrently.\n\n5. When unlinking unaccepted child sockets during listener release,\n   unlink them from local->sockets, call sock_orphan(), and drop their\n   initial sk_alloc creation reference via sock_put().\n\n6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with\n   a NULL check.","summary":"A race between socket release and accept() in the Linux kernel's NFC LLCP code can unlink and free the same child socket twice. The result is a use-after-free or NULL pointer dereference in the kernel, which can crash the machine or possibly be turned into code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","nfc","runtime","self-hosted"],"not_affected_if":["nfc-module-not-loaded","no-nfc-hardware"],"how_to_check":"- Check the running kernel with `uname -r` and compare it to the fixed versions in the kernel's stable branch, which the sources do not list.\n- Check whether the NFC LLCP module is loaded with `lsmod | grep nfc` or whether `nfc` is built in.\n- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit fixing nfc: llcp accept_queue lifecycle; the exact fixed version is unknown from the sources.\n- If NFC is not needed, blacklist the module with `modprobe -r nfc` and add `install nfc /bin/false` to a modprobe.d file.","status":"open","published_at":"2026-10-18T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:05+00:00","updated_at":"2026-10-25T05:23:05+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit fixing nfc: llcp accept_queue lifecycle; the exact fixed version is unknown from the sources.\n- If NFC is not needed, blacklist the module with `modprobe -r nfc` and add `install nfc /bin/false` to a modprobe.d file.","reach":"local","title":"Linux kernel NFC LLCP: race in accept queue can cause use-after-free","impact":"high","summary":"A race between socket release and accept() in the Linux kernel's NFC LLCP code can unlink and free the same child socket twice. The result is a use-after-free or NULL pointer dereference in the kernel, which can crash the machine or possibly be turned into code execution.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","nfc","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption that crashes the system or may allow code execution","analyst_note":"Find the upstream fix commit and the first fixed stable kernel versions for CVE-2026-98580 and confirm the attack surface (local versus remote).","how_to_check":"- Check the running kernel with `uname -r` and compare it to the fixed versions in the kernel's stable branch, which the sources do not list.\n- Check whether the NFC LLCP module is loaded with `lsmod | grep nfc` or whether `nfc` is built in.\n- unknown","needs_analyst":true,"not_affected_if":["no-nfc-hardware","nfc-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with NFC support enabled and the LLCP protocol in use are affected, which mainly means machines with NFC hardware or NFC drivers loaded. Servers, containers and cloud VMs without NFC support typically do not load the affected code, and the sources do not say whether unprivileged users can reach it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000741,"input_tokens":3908,"output_tokens":701,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98580':17A,20A '1':201C '2':229C '3':281C '4':303C '5':332C '6':360C 'accept':7A,34B,95C,106C,136C,139C,178C,307C,364C 'access':370C 'acquir':224C 'addit':268C 'alloc':354C 'atom':256C 'avoid':251C 'bh':116C,120C,198C 'bug':257C 'call':346C 'caus':10A 'check':145C,374C 'child':49B,159C,173C,336C 'close':330C 'code':42B,77B 'concurr':153C,331C 'condit':93C 'context':129C,193C,267C 'crash':69B 'creation':355C 'cve':15A,18A 'defer':235C 'dequeu':137C 'derefer':63B,171C 'destruct':280C 'devic':272C 'drop':264C,350C 'execut':78B 'final':237C,279C 'fix':91C,180C 'follow':84C 'free':14A,46B,59B,166C 'get':286C,289C 'guard':368C 'hang':325C 'held':132C 'hold':226C,269C 'host':27B 'howev':119C 'idempot':366C 'initi':352C 'instead':196C 'kernel':2A,21B,38B,66B,82C 'kref':288C 'last':260C 'lifecycl':97C 'linux':1A,22B,37B,81C 'list':208C,217C 'listen':105C,311C,317C,328C,339C 'llcp':4A,41B,90C,100C,135C,177C,187C,215C,242C,284C,305C,316C,363C 'local':112C,206C,243C,261C,275C,285C,296C,344C 'lock':117C,121C,130C,194C,199C,212C,220C,231C 'machin':71B 'make':361C 'nfc':3A,23B,40B,89C,99C,134C,176C,186C,214C,241C,283C,362C 'null':61B,169C,373C 'object':297C 'orphan':348C 'own':147C 'parent':174C,369C 'path':151C 'pointer':62B,170C 'pop':202C,218C 'possibl':73B 'prevent':293C,324C 'process':128C,192C 'process-context':127C,191C 'put':359C 'queue':8A,96C,107C 'race':5A,29B,92C,183C 'refer':262C,273C,356C 'registr':277C 'releas':32B,102C,142C,156C,189C,238C,248C,340C 'resolv':88C 'result':53B,161C 'resurrect':294C 'runtim':24B 'rwlock':114C,228C 'schedul':302C,321C 'self':26B 'self-host':25B 'singl':271C 'sk':353C 'sleep':234C,254C 'sleeping-in-atom':253C 'sock':118C,122C,131C,146C,195C,200C,216C,221C,232C,306C,347C,358C 'socket':31B,50B,101C,103C,113C,141C,160C,188C,203C,207C,312C,337C,345C 'softirq':266C 'state':313C 'still':315C 'structur':244C 'synchronis':125C,182C 'teardown':299C 'timeout':322C 'turn':75B 'twice':51B 'unaccept':335C 'unless':290C 'unlink':44B,154C,179C,334C,341C,365C 'use':12A,57B,164C,190C,213C,287C 'use-after-fre':11A,56B,163C 'user':149C 'verifi':308C 'via':357C 'vulner':85C 'wake':319C 'walk':109C 'whose':298C 'without':225C 'work':249C 'workqueu':247C 'write':211C 'zero':291C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with NFC support enabled and the LLCP protocol in use are affected, which mainly means machines with NFC hardware or NFC drivers loaded. Servers, containers and cloud VMs without NFC support typically do not load the affected code, and the sources do not say whether unprivileged users can reach it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98580","severity":null,"published_at":"2026-10-18T16:17:10+00:00","modified_at":"2026-10-19T10:19:18+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}