{"id":"CVE-2026-98581","kind":"vulnerability","aliases":["CVE-2026-98581"],"related":[],"title":"Linux kernel NFC LLCP: socket list corruption leads to memory exhaustion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()\n\nnfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still\nlinked on local->connecting_sockets: it looks the socket up with\nnfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and\nreturns, without taking the socket lock and without unlinking the socket\nfrom the connecting_sockets list.\n\nllcp_sock_release() selects the list to unlink from by sk_state: a socket\nin LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the\nsockets list.  Because recv_dm left the socket physically on\nconnecting_sockets but in the LLCP_CLOSED state, release() takes the else\nbranch and calls nfc_llcp_sock_unlink(&local->sockets, sk).  That runs\nsk_del_node_init() while holding sockets.lock, i.e. it removes the socket\nfrom the connecting_sockets hlist under the wrong lock.  A concurrent\nconnect() linking another socket onto connecting_sockets under\nconnecting_sockets.lock then mutates the same hlist unserialized, which\ncorrupts the list and desyncs the sk_add_node()/sk_del_node_init()\nsock_hold()/__sock_put() pairing.  An unprivileged local process holding\nLLCP sockets, with the DM supplied by the remote peer over an established\nLLCP link, can drive this to leak kernel sockets without bound (the\nmis-decrement goes through the non-freeing __sock_put() path, so the\nobject is never released), leading to memory exhaustion / DoS.\n\nThis is the same class of bug that was fixed in the sibling handler\nnfc_llcp_recv_cc() by commit b493ea2765cc (\"nfc: llcp: Fix use-after-free\nrace in nfc_llcp_recv_cc()\"); recv_dm did not receive the equivalent fix.\n\nFix it the same way: take lock_sock(), re-check that the socket is still\nhashed (release() may have won the race), and for the NOBOUND/REJ case\nunlink it from connecting_sockets before moving it to LLCP_CLOSED.  The\nunlink drops the connecting_sockets membership reference via\nsk_del_node_init(), leaving the socket unhashed, so the later\nnfc_llcp_sock_unlink() in llcp_sock_release() becomes a no-op and no\ndouble put occurs.","summary":"A local process holding LLCP sockets can corrupt the NFC LLCP connecting-socket list when a remote peer sends a DM frame. Repeated exploitation leaks kernel sockets without bound, which can exhaust memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","nfc","other"],"not_affected_if":["nfc-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:01+00:00","updated_at":"2026-10-25T05:23:01+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:23:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel NFC LLCP: socket list corruption leads to memory exhaustion","impact":"low","summary":"A local process holding LLCP sockets can corrupt the NFC LLCP connecting-socket list when a remote peer sends a DM frame. Repeated exploitation leaks kernel sockets without bound, which can exhaust memory.","category":"other","nicknames":[],"who_cares":["linux-kernel","nfc"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel socket leak exhausts memory, causing denial of service","analyst_note":"Check the kernel stable backport commits and affected version ranges at the NVD entry for CVE-2026-98581 to fill in fix and how_to_check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["nfc-disabled"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000592,"input_tokens":4087,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98581':14A,17A '/__sock_put':242C '/dm':85C '/sk_del_node_init':239C 'add':237C 'anoth':216C 'b493ea2765cc':317C 'becom':406C 'bound':51B,272C 'branch':179C 'bug':303C 'call':181C 'case':366C 'cc':314C,330C 'check':349C 'class':301C 'close':114C,173C,377C 'commit':316C 'concurr':213C 'connect':34B,96C,106C,129C,148C,152C,167C,205C,214C,219C,370C,382C 'connecting-socket':33B 'connecting_sockets.lock':222C 'corrupt':7A,29B,70C,230C 'cve':12A,15A 'decrement':276C 'del':192C,388C 'desync':72C,234C 'dm':43B,77C,81C,83C,161C,253C,332C 'dos':296C 'doubl':413C 'drive':265C 'drop':380C 'els':178C 'equival':337C 'establish':261C 'exhaust':11A,54B,295C 'exploit':46B 'fix':68C,306C,320C,338C,339C 'follow':61C 'frame':44B 'free':282C,324C 'get':108C 'goe':277C 'handl':82C 'handler':310C 'hash':355C 'hlist':207C,227C 'hold':25B,196C,241C,248C 'i.e':198C 'init':194C,390C 'kernel':2A,20B,48B,59C,269C 'later':397C 'lead':8A,292C 'leak':47B,268C 'leav':391C 'left':162C 'link':93C,215C,263C 'linux':1A,19B,58C 'linux-kernel':18B 'list':6A,36B,69C,131C,137C,158C,232C 'llcp':4A,26B,32B,67C,75C,79C,105C,113C,132C,147C,172C,183C,249C,262C,312C,319C,328C,376C,399C,403C 'local':23B,95C,186C,246C 'lock':121C,211C,345C 'look':99C 'may':357C 'membership':384C 'memori':10A,55B,294C 'mis':275C 'mis-decr':274C 'move':373C 'mutat':224C 'never':290C 'nfc':3A,21B,31B,66C,74C,78C,104C,182C,311C,318C,327C,398C 'no-op':408C 'nobound':84C 'nobound/rej':365C 'node':193C,238C,389C 'non':281C 'non-fre':280C 'object':288C 'occur':415C 'onto':218C 'op':410C 'otherwis':154C 'pair':243C 'path':285C 'peer':40B,258C 'physic':165C 'process':24B,247C 'put':284C,414C 'race':325C,361C 're':348C 're-check':347C 'receiv':335C 'recv':76C,80C,160C,313C,329C,331C 'refcount':71C 'refer':385C 'rej':86C 'releas':134C,175C,291C,356C,405C 'remot':39B,257C 'remov':200C 'repeat':45B 'resolv':65C 'return':116C 'run':190C 'select':135C 'send':41B 'set':109C 'sibl':309C 'sk':110C,111C,142C,188C,191C,236C,387C 'sock':107C,133C,184C,240C,283C,346C,400C,404C 'socket':5A,27B,35B,49B,89C,97C,101C,120C,126C,130C,145C,153C,157C,164C,168C,187C,202C,206C,217C,220C,250C,270C,352C,371C,383C,393C 'sockets.lock':197C 'state':112C,143C,174C 'still':92C,354C 'suppli':254C 'take':118C,176C,344C 'unhash':394C 'unlink':124C,139C,150C,185C,367C,379C,401C 'unprivileg':245C 'unseri':228C 'use':322C 'use-after-fre':321C 'via':386C 'vulner':62C 'way':343C 'without':50B,117C,123C,271C 'won':359C 'wrong':210C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98581","severity":null,"published_at":"2026-10-18T16:17:10+00:00","modified_at":"2026-10-19T10:19:18+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}