In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()… (CVE-2026-98581)

The Linux kernel NFC LLCP implementation had a flaw in the nfc_llcp_recv_dm() function where sockets in the connecting_sockets list were not properly locked or unlinked when handling DM(NOBOUND)/DM(REJ) messages. This caused the socket state to be set to LLCP_CLOSED while still linked on connecting_sockets, leading to incorrect unlinking under the wrong lock in llcp_sock_release(). Concurrent operations could corrupt the connecting_sockets list and desynchronize socket reference counting, causing kernel socket objects to leak and never be freed. This memory leak can be triggered by an unprivileged local process holding LLCP sockets with DM messages from a remote peer, potentially causing denial of service via memory exhaustion. The fix applies locking and unlinking steps similar to a previous fix for a related issue in nfc_llcp_recv_cc(), ensuring proper socket state transitions and reference management.

An unprivileged local user can cause kernel socket objects to leak by triggering list corruption and reference count desynchronization in the NFC LLCP socket handling code. This leads to memory exhaustion in the kernel, resulting in a denial of service condition. There is no indication of privilege escalation or remote code execution. The impact is limited to local denial of service via resource exhaustion.

A fix has been implemented in the Linux kernel to properly lock and unlink sockets in the nfc_llcp_recv_dm() function, preventing list corruption and reference count desynchronization. Users should update to the fixed kernel version containing this patch. No additional mitigation is required once the fix is applied.