---
id: CVE-2026-98580
title: 'nfc: llcp: Fix race condition in accept_queue lifecycle'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfc: llcp: Fix race condition in accept_queue lifecycle

  In nfc_llcp_socket_release(), sockets and listener accept queues are
  walked under the local sockets rwlock and …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe <
    54adcabb0f1deef1bdae5fc64779ed6d442721c9
  - >-
    Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe <
    7c938aad5108382c6ad7453c4b5ee8ae3f3252ed
  - >-
    Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe <
    d2093a0981138876212bc5f473bdbfba0786e064
  - >-
    Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe <
    41256821762a7114906b178826d17098e2fa5992
  - >-
    Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe <
    53867f6acb1af7f12d6485fa8a2819318f89083b
  - >-
    Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe <
    da8a07757383614a8380a0f7dd54749d2687b82e
  - >-
    Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe <
    d5e1c92d09caed19f2988739695ce611a86ba6f8
  - >-
    Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe <
    c3eef2f988a3db9690369d7cef9a3344dd9788d3
  - Linux 3.7
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:18:53.819Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98580'
references:
  - url: 'https://git.kernel.org/stable/c/54adcabb0f1deef1bdae5fc64779ed6d442721c9'
  - url: 'https://git.kernel.org/stable/c/7c938aad5108382c6ad7453c4b5ee8ae3f3252ed'
  - url: 'https://git.kernel.org/stable/c/d2093a0981138876212bc5f473bdbfba0786e064'
  - url: 'https://git.kernel.org/stable/c/41256821762a7114906b178826d17098e2fa5992'
  - url: 'https://git.kernel.org/stable/c/53867f6acb1af7f12d6485fa8a2819318f89083b'
  - url: 'https://git.kernel.org/stable/c/da8a07757383614a8380a0f7dd54749d2687b82e'
  - url: 'https://git.kernel.org/stable/c/d5e1c92d09caed19f2988739695ce611a86ba6f8'
  - url: 'https://git.kernel.org/stable/c/c3eef2f988a3db9690369d7cef9a3344dd9788d3'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.254Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix race condition in accept_queue lifecycle

In nfc_llcp_socket_release(), sockets and listener accept queues are
walked under the local sockets rwlock and bh_lock_sock().  However,
bh_lock_sock() does not synchronise against process-context lock_sock()
held by nfc_llcp_accept_dequeue() during accept().  Because
socket_release() does not check sock_owned_by_user(), both paths can
concurrently unlink and release the same child socket, resulting in
use-after-free or a NULL pointer dereference of child->parent in
nfc_llcp_accept_unlink().

Fix this synchronisation race by having nfc_llcp_socket_release() use
process-context lock_sock() instead of bh_lock_sock():

1. Pop sockets from the local sockets list under the write lock using
   nfc_llcp_sock_list_pop() so lock_sock() can be acquired without
   holding the rwlock.

2. Because lock_sock() can sleep, defer the final release of the
   nfc_llcp_local structure to a workqueue (release_work).  This avoids
   a sleeping-in-atomic bug when the last local reference is dropped
   from softirq context.  Additionally, hold a single device reference
   on local from registration until final destruction.

3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent
   resurrecting a local object whose teardown has been scheduled.

4. In llcp_sock_accept(), verify that the listener socket state is still
   LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if
   the listener is closed concurrently.

5. When unlinking unaccepted child sockets during listener release,
   unlink them from local->sockets, call sock_orphan(), and drop their
   initial sk_alloc creation reference via sock_put().

6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with
   a NULL check.

## Affected

- `Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe < 54adcabb0f1deef1bdae5fc64779ed6d442721c9`
- `Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe < 7c938aad5108382c6ad7453c4b5ee8ae3f3252ed`
- `Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe < d2093a0981138876212bc5f473bdbfba0786e064`
- `Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe < 41256821762a7114906b178826d17098e2fa5992`
- `Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe < 53867f6acb1af7f12d6485fa8a2819318f89083b`
- `Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe < da8a07757383614a8380a0f7dd54749d2687b82e`
- `Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe < d5e1c92d09caed19f2988739695ce611a86ba6f8`
- `Linux >= 50b78b2a6500d0e97c204c1b6c51df8c17358bbe < c3eef2f988a3db9690369d7cef9a3344dd9788d3`
- `Linux 3.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.