CVE-2026-98580
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
nfc: llcp: Corrige una condición de carrera en el ciclo de vida de la cola accept_queue
En nfc_llcp_socket_release(), los sockets y las colas accept de los oyentes se recorren bajo el rwlock de sockets locales y bh_lock_sock(). Sin embargo, bh_lock_sock() no se sincroniza con el lock_sock() en contexto de proceso que mantiene nfc_llcp_accept_dequeue() durante accept(). Como socket_release() no comprueba sock_owned_by_user(), ambas rutas pueden desvincular y liberar concurrentemente el mismo socket hijo, lo que provoca un use-after-free o una desreferencia de puntero NULL en child->parent dentro de nfc_llcp_accept_unlink().
Leer descripción completaMostrar menos
Para corregir esta condición de carrera de sincronización, nfc_llcp_socket_release() utiliza lock_sock() en contexto de proceso en lugar de bh_lock_sock():
1. Extrae los sockets de la lista de sockets locales bajo el write lock mediante nfc_llcp_sock_list_pop(), de modo que lock_sock() pueda adquirirse sin mantener el rwlock.
2. Como lock_sock() puede dormir, la liberación final de la estructura nfc_llcp_local se pospone a una workqueue (release_work). Así se evita un fallo de dormir en contexto atómico cuando la última referencia local se libera desde contexto softirq. Además, se mantiene una única referencia de dispositivo sobre local desde el registro hasta la destrucción final.
3. En nfc_llcp_local_get(), se utiliza kref_get_unless_zero() para impedir resucitar un objeto local cuya destrucción ya está programada.
4. En llcp_sock_accept(), tras despertar de schedule_timeout(), se verifica que el estado del socket oyente sigue siendo LLCP_LISTEN, para evitar bloqueos si el oyente se cierra concurrentemente.
5. Al desvincular los sockets hijos no aceptados durante la liberación del oyente, se desvinculan de local->sockets, se llama a sock_orphan() y se libera su referencia inicial de creación de sk_alloc mediante sock_put().
6. Se hace idempotente nfc_llcp_accept_unlink() protegiendo el acceso a parent con una comprobación de NULL.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/41256821762a7114906b178826d17098e2fa5992
- https://git.kernel.org/stable/c/53867f6acb1af7f12d6485fa8a2819318f89083b
- https://git.kernel.org/stable/c/54adcabb0f1deef1bdae5fc64779ed6d442721c9
- https://git.kernel.org/stable/c/7c938aad5108382c6ad7453c4b5ee8ae3f3252ed
- https://git.kernel.org/stable/c/c3eef2f988a3db9690369d7cef9a3344dd9788d3
- https://git.kernel.org/stable/c/d2093a0981138876212bc5f473bdbfba0786e064
- https://git.kernel.org/stable/c/d5e1c92d09caed19f2988739695ce611a86ba6f8
- https://git.kernel.org/stable/c/da8a07757383614a8380a0f7dd54749d2687b82e
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98580",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "50b78b2a6500d0e97c204c1b6c51df8c17358bbe",
"lessThan": "54adcabb0f1deef1bdae5fc64779ed6d442721c9",
"versionType": "git"
},
{
"status": "affected",
"version": "50b78b2a6500d0e97c204c1b6c51df8c17358bbe",
"lessThan": "7c938aad5108382c6ad7453c4b5ee8ae3f3252ed",
"versionType": "git"
},
{
"status": "affected",
"version": "50b78b2a6500d0e97c204c1b6c51df8c17358bbe",
"lessThan": "d2093a0981138876212bc5f473bdbfba0786e064",
"versionType": "git"
},
{
"status": "affected",
"version": "50b78b2a6500d0e97c204c1b6c51df8c17358bbe",
"lessThan": "41256821762a7114906b178826d17098e2fa5992",
"versionType": "git"
},
{
"status": "affected",
"version": "50b78b2a6500d0e97c204c1b6c51df8c17358bbe",
"lessThan": "53867f6acb1af7f12d6485fa8a2819318f89083b",
"versionType": "git"
},
{
"status": "affected",
"version": "50b78b2a6500d0e97c204c1b6c51df8c17358bbe",
"lessThan": "da8a07757383614a8380a0f7dd54749d2687b82e",
"versionType": "git"
},
{
"status": "affected",
"version": "50b78b2a6500d0e97c204c1b6c51df8c17358bbe",
"lessThan": "d5e1c92d09caed19f2988739695ce611a86ba6f8",
"versionType": "git"
},
{
"status": "affected",
"version": "50b78b2a6500d0e97c204c1b6c51df8c17358bbe",
"lessThan": "c3eef2f988a3db9690369d7cef9a3344dd9788d3",
"versionType": "git"
}
],
"programFiles": [
"net/nfc/llcp.h",
"net/nfc/llcp_core.c",
"net/nfc/llcp_sock.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/nfc/llcp.h",
"net/nfc/llcp_core.c",
"net/nfc/llcp_sock.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:10.483",
"references": [
{
"url": "https://git.kernel.org/stable/c/41256821762a7114906b178826d17098e2fa5992",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/53867f6acb1af7f12d6485fa8a2819318f89083b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/54adcabb0f1deef1bdae5fc64779ed6d442721c9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c938aad5108382c6ad7453c4b5ee8ae3f3252ed",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c3eef2f988a3db9690369d7cef9a3344dd9788d3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d2093a0981138876212bc5f473bdbfba0786e064",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d5e1c92d09caed19f2988739695ce611a86ba6f8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da8a07757383614a8380a0f7dd54749d2687b82e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix race condition in accept_queue lifecycle\n\nIn nfc_llcp_socket_release(), sockets and listener accept queues are\nwalked under the local sockets rwlock and bh_lock_sock(). However,\nbh_lock_sock() does not synchronise against process-context lock_sock()\nheld by nfc_llcp_accept_dequeue() during accept(). Because\nsocket_release() does not check sock_owned_by_user(), both paths can\nconcurrently unlink and release the same child socket, resulting in\nuse-after-free or a NULL pointer dereference of child->parent in\nnfc_llcp_accept_unlink().\n\nFix this synchronisation race by having nfc_llcp_socket_release() use\nprocess-context lock_sock() instead of bh_lock_sock():\n\n1. Pop sockets from the local sockets list under the write lock using\n nfc_llcp_sock_list_pop() so lock_sock() can be acquired without\n holding the rwlock.\n\n2. Because lock_sock() can sleep, defer the final release of the\n nfc_llcp_local structure to a workqueue (release_work). This avoids\n a sleeping-in-atomic bug when the last local reference is dropped\n from softirq context. Additionally, hold a single device reference\n on local from registration until final destruction.\n\n3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent\n resurrecting a local object whose teardown has been scheduled.\n\n4. In llcp_sock_accept(), verify that the listener socket state is still\n LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if\n the listener is closed concurrently.\n\n5. When unlinking unaccepted child sockets during listener release,\n unlink them from local->sockets, call sock_orphan(), and drop their\n initial sk_alloc creation reference via sock_put().\n\n6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with\n a NULL check."
}
],
"lastModified": "2026-10-19T10:19:18.640",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}