CVE-2026-90224 addresses a race condition in the Linux kernel NFC nci driver where nci_close_device() and nci_rx_work could concurrently invoke nci_data_exchange_complete(). After a prior change moved flush_workqueue() to after unlocking a mutex, serialization was lost, allowing both callers to read a non-NULL callback pointer and call rawsock_data_exchange_complete(), which calls sock_put(). Since only one sock_hold() was taken, the second sock_put() caused a reference count underflow, freeing the socket prematurely while still in use. The patch replaces clear_bit(NCI_DATA_EXCHANGE) with test_and_clear_bit() to ensure only one caller proceeds with the callback invocation.

This vulnerability can lead to use-after-free conditions in the kernel's socket handling, potentially causing system instability, crashes, or privilege escalation due to corrupted kernel memory. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability.

A fix has been implemented in the Linux kernel to address this race condition. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation requires updating affected Linux kernel versions once the patch is released. Patch status is not explicitly stated here; check the vendor advisory for the exact fixed versions and update accordingly.