Executive brief
The Linux kernel's NFC (Near Field Communication) LLCP socket implementation contains a race condition that allows a local attacker to trigger a use-after-free vulnerability. An attacker can cause the kernel to dereference memory that has been freed, potentially leading to denial of service or local privilege escalation. This vulnerability affects systems with NFC functionality enabled.
Technical details
The vulnerability exists in the nfc_llcp_getsockopt() function in net/nfc/llcp_sock.c. The function reads the llcp_sock->local pointer before acquiring the socket lock (lock_sock), but dereferences it after the lock is acquired. Concurrently, llcp_sock_bind() modifies or frees the same pointer under the socket lock, creating a race condition. An attacker can invoke getsockopt() while simultaneously executing bind() on an NFC LLCP socket to observe the pointer, wait at the lock acquisition point, and then dereference freed memory once bind() has unwound. The fix moves the pointer read and NULL check inside the lock_sock() region to prevent mutation or freeing between load and use. This is a race-condition/use-after-free vulnerability (CWE-416) reachable via local socket operations requiring minimum unprivileged user privileges.
Affected products
- Linux Linux kernel Affected versions (exact range not specified in advisory; patch 36812527052c5bfb1ec6c1e292d67a5bf76b750f)
Timeline
- 2026-09-17: disclosed: Public advisory published
- 2026-05-21: patched: Upstream fix commit 36812527052c5bfb1ec6c1e292d67a5bf76b750f by Breno Leitao
- 2026-09-14: other: Patch merged to stable kernel trees by Greg Kroah-Hartman