CVE-2026-98581
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
nfc_llcp_recv_dm() gestiona DM(NOBOUND)/DM(REJ) para un socket que sigue enlazado en local->connecting_sockets: lo localiza con nfc_llcp_connecting_sock_get(), establece sk->sk_state = LLCP_CLOSED y retorna, sin tomar el bloqueo del socket y sin desenlazar el socket de la lista connecting_sockets.
llcp_sock_release() selecciona de qué lista desenlazar según sk_state: un socket en LLCP_CONNECTING se desenlaza de connecting_sockets; en caso contrario, de la lista sockets.
Leer descripción completaMostrar menos
Como recv_dm dejó el socket físicamente en connecting_sockets pero en el estado LLCP_CLOSED, release() toma la rama else y llama a nfc_llcp_sock_unlink(&local->sockets, sk). Eso ejecuta sk_del_node_init() manteniendo sockets.lock, es decir, elimina el socket de la hlist connecting_sockets bajo el bloqueo equivocado. Una llamada concurrente a connect() que enlace otro socket en connecting_sockets bajo connecting_sockets.lock modifica la misma hlist sin serialización, lo que corrompe la lista y desincroniza el emparejamiento sock_hold()/__sock_put() de sk_add_node()/sk_del_node_init(). Un proceso local sin privilegios que mantenga sockets LLCP, con el DM enviado por el par remoto sobre un enlace LLCP establecido, puede provocar que se filtren sockets del kernel sin límite (el decremento erróneo pasa por la ruta __sock_put() que no libera el objeto, de modo que nunca se libera), lo que conduce a agotamiento de memoria / DoS.
Es la misma clase de fallo que se corrigió en el manejador hermano nfc_llcp_recv_cc() mediante el commit b493ea2765cc ("nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()"); recv_dm no recibió la corrección equivalente.
Se corrige de la misma forma: llamar a lock_sock(), volver a comprobar que el socket sigue en la tabla hash (release() puede haber ganado la carrera) y, en el caso NOBOUND/REJ, desenlazarlo de connecting_sockets antes de pasarlo a LLCP_CLOSED. El desenlace elimina la referencia de pertenencia a connecting_sockets mediante sk_del_node_init(), dejando el socket sin estar en la tabla hash, de modo que el posterior nfc_llcp_sock_unlink() en llcp_sock_release() pasa a no tener efecto y no se produce un doble decremento.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1
- https://git.kernel.org/stable/c/7fb2c0eeb79bfad64065f539a453138abd0edda6
- https://git.kernel.org/stable/c/812731dd8511f5768f4ff279b3c18d85cd21da4b
- https://git.kernel.org/stable/c/b94cf09720543cc34256c7aa88f8059cbe7c0419
- https://git.kernel.org/stable/c/bf1460acdf8cf5a07c819f59785d40f20d113099
- https://git.kernel.org/stable/c/c1e9ed52a6697354366dddf190fbacee8ed2f7c5
- https://git.kernel.org/stable/c/dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08
- https://git.kernel.org/stable/c/dd2d24add86b3b63cd87cf2feff98ae119ba19a6
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98581",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"lessThan": "dd2d24add86b3b63cd87cf2feff98ae119ba19a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"lessThan": "812731dd8511f5768f4ff279b3c18d85cd21da4b",
"versionType": "git"
},
{
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"lessThan": "dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08",
"versionType": "git"
},
{
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"lessThan": "c1e9ed52a6697354366dddf190fbacee8ed2f7c5",
"versionType": "git"
},
{
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"lessThan": "7fb2c0eeb79bfad64065f539a453138abd0edda6",
"versionType": "git"
},
{
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"lessThan": "b94cf09720543cc34256c7aa88f8059cbe7c0419",
"versionType": "git"
},
{
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"lessThan": "320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1",
"versionType": "git"
},
{
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"lessThan": "bf1460acdf8cf5a07c819f59785d40f20d113099",
"versionType": "git"
}
],
"programFiles": [
"net/nfc/llcp_core.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/nfc/llcp_core.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:10.610",
"references": [
{
"url": "https://git.kernel.org/stable/c/320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7fb2c0eeb79bfad64065f539a453138abd0edda6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/812731dd8511f5768f4ff279b3c18d85cd21da4b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b94cf09720543cc34256c7aa88f8059cbe7c0419",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf1460acdf8cf5a07c819f59785d40f20d113099",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c1e9ed52a6697354366dddf190fbacee8ed2f7c5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dd2d24add86b3b63cd87cf2feff98ae119ba19a6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()\n\nnfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still\nlinked on local->connecting_sockets: it looks the socket up with\nnfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and\nreturns, without taking the socket lock and without unlinking the socket\nfrom the connecting_sockets list.\n\nllcp_sock_release() selects the list to unlink from by sk_state: a socket\nin LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the\nsockets list. Because recv_dm left the socket physically on\nconnecting_sockets but in the LLCP_CLOSED state, release() takes the else\nbranch and calls nfc_llcp_sock_unlink(&local->sockets, sk). That runs\nsk_del_node_init() while holding sockets.lock, i.e. it removes the socket\nfrom the connecting_sockets hlist under the wrong lock. A concurrent\nconnect() linking another socket onto connecting_sockets under\nconnecting_sockets.lock then mutates the same hlist unserialized, which\ncorrupts the list and desyncs the sk_add_node()/sk_del_node_init()\nsock_hold()/__sock_put() pairing. An unprivileged local process holding\nLLCP sockets, with the DM supplied by the remote peer over an established\nLLCP link, can drive this to leak kernel sockets without bound (the\nmis-decrement goes through the non-freeing __sock_put() path, so the\nobject is never released), leading to memory exhaustion / DoS.\n\nThis is the same class of bug that was fixed in the sibling handler\nnfc_llcp_recv_cc() by commit b493ea2765cc (\"nfc: llcp: Fix use-after-free\nrace in nfc_llcp_recv_cc()\"); recv_dm did not receive the equivalent fix.\n\nFix it the same way: take lock_sock(), re-check that the socket is still\nhashed (release() may have won the race), and for the NOBOUND/REJ case\nunlink it from connecting_sockets before moving it to LLCP_CLOSED. The\nunlink drops the connecting_sockets membership reference via\nsk_del_node_init(), leaving the socket unhashed, so the later\nnfc_llcp_sock_unlink() in llcp_sock_release() becomes a no-op and no\ndouble put occurs."
}
],
"lastModified": "2026-10-19T10:19:18.807",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}