CVE-2026-90225nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 before 56fd158fef20268f48db6cdfe5d722e930134eda; 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 builds before 8ba8cec0586727cc135ca4827921fc7b52946d71; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 before ed5240bab3468988077fe8bf29b935eaecc9ff89; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 before fe65727a4a21b11c18eebae1338482767a897b76; 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 builds before 2d8ac24565be85bf56580b87bf1b874d35625eb5; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 before 156e65bd29307f5053835bff60bc1ba342fa010f; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 before d1b73962675cdc5a58e2707e25b548d8b495fde0; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 before 36812527052c5bfb1ec6c1e292d67a5bf76b750f | CNA record |
References
- https://git.kernel.org/stable/c/56fd158fef20268f48db6cdfe5d722e930134eda
- https://git.kernel.org/stable/c/8ba8cec0586727cc135ca4827921fc7b52946d71
- https://git.kernel.org/stable/c/ed5240bab3468988077fe8bf29b935eaecc9ff89
- https://git.kernel.org/stable/c/fe65727a4a21b11c18eebae1338482767a897b76
- https://git.kernel.org/stable/c/2d8ac24565be85bf56580b87bf1b874d35625eb5
- https://git.kernel.org/stable/c/156e65bd29307f5053835bff60bc1ba342fa010f
- https://git.kernel.org/stable/c/d1b73962675cdc5a58e2707e25b548d8b495fde0
- https://git.kernel.org/stable/c/36812527052c5bfb1ec6c1e292d67a5bf76b750f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.