CVE-2026-90225

nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound.

Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 56fd158fef20268f48db6cdfe5d722e930134edaAffected 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 8ba8cec0586727cc135ca4827921fc7b52946d71Affected 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before ed5240bab3468988077fe8bf29b935eaecc9ff89Affected 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before fe65727a4a21b11c18eebae1338482767a897b76Affected 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 2d8ac24565be85bf56580b87bf1b874d35625eb5Affected 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 156e65bd29307f5053835bff60bc1ba342fa010fAffected 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before d1b73962675cdc5a58e2707e25b548d8b495fde0Affected 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 36812527052c5bfb1ec6c1e292d67a5bf76b750fAffected
LinuxLinux	3.10Affected before 3.10Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 56fd158fef20268f48db6cdfe5d722e930134edaAffected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 8ba8cec0586727cc135ca4827921fc7b52946d71Affected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before ed5240bab3468988077fe8bf29b935eaecc9ff89Affected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before fe65727a4a21b11c18eebae1338482767a897b76Affected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 2d8ac24565be85bf56580b87bf1b874d35625eb5Affected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 156e65bd29307f5053835bff60bc1ba342fa010fAffected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before d1b73962675cdc5a58e2707e25b548d8b495fde0Affected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to before 36812527052c5bfb1ec6c1e292d67a5bf76b750fAffected

LinuxLinux

3.10Affected
before 3.10Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.