The vulnerability (CVE-2026-90225) in the Linux kernel NFC LLCP socket code was caused by nfc_llcp_getsockopt() reading the llcp_sock->local pointer before acquiring the socket lock, then dereferencing it inside the locked region. Meanwhile, llcp_sock_bind() modifies and frees this pointer under the socket lock. A race between getsockopt() and bind() could cause getsockopt() to dereference a freed pointer, leading to use-after-free. The fix moves the pointer read and null check inside the socket lock to prevent concurrent mutation or freeing during use.

This vulnerability can lead to use-after-free conditions, potentially allowing attackers with local privileges to cause kernel memory corruption. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. Exploitation could result in privilege escalation or denial of service.

A fix has been implemented in the Linux kernel that moves the pointer read and null check inside the socket lock to prevent race conditions. Users should apply the official kernel updates that include this patch. No additional mitigations are indicated.