VulnerabilityPublished 18 Oct 2026

CVE-2026-98581: Linux kernel · nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

Source GCVE Database

Authoritative record:CVE-2026-98581· High

Not known to be exploited · fixed in dd2d24add86b3b63cd87cf2feff98ae119ba19a6 : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in dd2d24add86b3b63cd87cf2feff98ae119ba19a6, dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08, c1e9ed52a6697354366dddf190fbacee8ed2f7c5 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-h227-88m5-f744

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ a69f32af86e389dd232b1bb2269e202c1bfcc60f, < dd2d24add86b3b63cd87cf2feff98ae119ba19a6	Fixed in dd2d24add86b3b63cd87cf2feff98ae119ba19a6
LinuxLinux	Affected ≥ a69f32af86e389dd232b1bb2269e202c1bfcc60f, < dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08	Fixed in dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08
LinuxLinux	Affected ≥ a69f32af86e389dd232b1bb2269e202c1bfcc60f, < c1e9ed52a6697354366dddf190fbacee8ed2f7c5	Fixed in c1e9ed52a6697354366dddf190fbacee8ed2f7c5
LinuxLinux	Affected ≥ a69f32af86e389dd232b1bb2269e202c1bfcc60f, < bf1460acdf8cf5a07c819f59785d40f20d113099	Fixed in bf1460acdf8cf5a07c819f59785d40f20d113099
LinuxLinux	Affected ≥ a69f32af86e389dd232b1bb2269e202c1bfcc60f, < b94cf09720543cc34256c7aa88f8059cbe7c0419	Fixed in b94cf09720543cc34256c7aa88f8059cbe7c0419
LinuxLinux	Affected ≥ a69f32af86e389dd232b1bb2269e202c1bfcc60f, < 812731dd8511f5768f4ff279b3c18d85cd21da4b	Fixed in 812731dd8511f5768f4ff279b3c18d85cd21da4b

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix has been implemented in the Linux kernel to properly lock and unlink sockets in the nfc_llcp_recv_dm() function, preventing list corruption and reference count desynchronization. Users should update to the fixed kernel version containing this patch. No additional mitigation is required once the fix is applied.

Description

A vulnerability in the Linux kernel's NFC LLCP socket handling was resolved. The flaw involves improper locking and unlinking of sockets in the nfc_llcp_recv_dm() function, leading to list corruption and reference count desynchronization. This can cause kernel socket objects to leak without being freed, potentially resulting in memory exhaustion and denial of service. The issue affects local unprivileged processes interacting with LLCP sockets and receiving specific DM messages from remote peers. The fix involves proper locking and unlinking of sockets to prevent double reference decrements and list corruption.

Impact

An unprivileged local user can cause kernel socket objects to leak by triggering list corruption and reference count desynchronization in the NFC LLCP socket handling code. This leads to memory exhaustion in the kernel, resulting in a denial of service condition. There is no indication of privilege escalation or remote code execution. The impact is limited to local denial of service via resource exhaustion.

References

Community reviews

Loading reviews…