In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in accept_queue lifecycle In… (CVE-2026-98580)

The vulnerability in the Linux kernel NFC LLCP socket subsystem arises from a race condition between nfc_llcp_socket_release() and nfc_llcp_accept_dequeue() during socket lifecycle management. The original code used bh_lock_sock() in socket release, which does not synchronize with the process-context lock_sock() used during accept dequeue. This allowed concurrent unlinking and releasing of the same child socket, causing use-after-free or NULL pointer dereference in nfc_llcp_accept_unlink(). The fix involves replacing bh_lock_sock() with lock_sock() in socket release, popping sockets under a write lock before locking, deferring final release to a workqueue to avoid sleeping in atomic context, preventing resurrection of local objects, verifying listener socket state after timeout, unlinking unaccepted child sockets properly, and making unlinking idempotent by guarding parent access with NULL checks.

The race condition could lead to use-after-free or NULL pointer dereference in the NFC LLCP socket handling code, potentially causing kernel crashes or instability. There is no indication of remote code execution or privilege escalation from the provided data. The impact is limited to kernel reliability and stability related to NFC socket operations.

A fix is available and has been applied to the Linux kernel source code. Users and administrators should update to the fixed kernel version containing this patch. No additional mitigation steps are indicated or required beyond applying the official fix.