Executive brief
The Linux kernel's NFC (Near Field Communication) subsystem contains a race condition in the NCI data exchange completion handler. When two code paths attempt to complete the same data exchange operation simultaneously, a socket reference count underflow occurs, causing the socket to be freed while still in use. This can lead to use-after-free conditions and potential kernel crashes or data corruption in systems using NFC functionality.
Technical details
This is a race condition (CWE-362) in the nci_data_exchange_complete() function within net/nfc/nci/data.c. The vulnerability occurs when nci_close_device() and nci_rx_work() both invoke nci_data_exchange_complete() concurrently. After a prior commit moved flush_workqueue() outside a mutex lock, these two callers are no longer serialized. Both read a non-NULL callback pointer and invoke rawsock_data_exchange_complete(), which calls sock_put() on a socket where only one sock_hold() reference was taken. The second sock_put() underflows the refcount and prematurely frees the socket while it remains in use. The fix replaces a bare clear_bit() with test_and_clear_bit() to ensure only the first caller proceeds with the callback. The vulnerability affects the Linux kernel's NFC subsystem and requires no special privileges or network access—it is local to systems with NFC hardware and active data exchange operations.
Affected products
- Linux Linux kernel all versions with vulnerable NFC NCI code path (approximately 3.x through 6.x with NFC enabled)
Timeline
- 2026-09-17: disclosed
- 2026-05-26: patched: Original upstream fix commit 8265a626cc14a48e46e6dc8c47667e72b4232ac2