CVE-2026-90226

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: avoid userspace overflow on invalid optlen

nfc_llcp_getsockopt() casts optval to (u32 __user *) for put_user(), so

the kernel always stores 4 bytes regardless of the caller-supplied

optlen. The existing min_t(u32, len, sizeof(u32)) only clamps the length

reported back to userspace; it does not constrain the store. A call with

optlen < 4 therefore writes past the user buffer, violating the

getsockopt(2) contract for all five supported optnames.

Reject any call with optlen < sizeof(u32) up front. 'len' is int, so a

plain size comparison would promote a negative optlen to size_t and slip

past the check; an explicit 'len < 0' test is added first to catch

negative values before the size compare.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References