CVE-2026-98581

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

nfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still

linked on local->connecting_sockets: it looks the socket up with

nfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and

returns, without taking the socket lock and without unlinking the socket

from the connecting_sockets list.

llcp_sock_release() selects the list to unlink from by sk_state: a socket

in LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the

sockets list. Because recv_dm left the socket physically on

connecting_sockets but in the LLCP_CLOSED state, release() takes the else

branch and calls nfc_llcp_sock_unlink(&local->sockets, sk). That runs

sk_del_node_init() while holding sockets.lock, i.e. it removes the socket

from the connecting_sockets hlist under the wrong lock. A concurrent

connect() linking another socket onto connect

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References