PT-2026-116799 · Linux · Linux
CVE-2026-98580
·
Publicado
2026-10-18
·
Atualizado
2026-10-18
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: Fix race condition in accept queue lifecycle
In nfc llcp socket release(), sockets and listener accept queues are
walked under the local sockets rwlock and bh lock sock(). However,
bh lock sock() does not synchronise against process-context lock sock()
held by nfc llcp accept dequeue() during accept(). Because
socket release() does not check sock owned by user(), both paths can
concurrently unlink and release the same child socket, resulting in
use-after-free or a NULL pointer dereference of child->parent in
nfc llcp accept unlink().
Fix this synchronisation race by having nfc llcp socket release() use
process-context lock sock() instead of bh lock sock():
-
Pop sockets from the local sockets list under the write lock using nfc llcp sock list pop() so lock sock() can be acquired without holding the rwlock.
-
Because lock sock() can sleep, defer the final release of the nfc llcp local structure to a workqueue (release work). This avoids a sleeping-in-atomic bug when the last local reference is dropped from softirq context. Additionally, hold a single device reference on local from registration until final destruction.
-
In nfc llcp local get(), use kref get unless zero() to prevent resurrecting a local object whose teardown has been scheduled.
-
In llcp sock accept(), verify that the listener socket state is still LLCP LISTEN after waking from schedule timeout() to prevent hangs if the listener is closed concurrently.
-
When unlinking unaccepted child sockets during listener release, unlink them from local->sockets, call sock orphan(), and drop their initial sk alloc creation reference via sock put().
-
Make nfc llcp accept unlink() idempotent by guarding parent access with a NULL check.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux