CVE-2021-38208

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.12.10

Description The issue is related to a NULL pointer dereference in the net/nfc/llcp sock.c component of the Linux kernel. It can be exploited by local unprivileged users to cause a denial of service by making a getsockname call after a certain type of failure of a bind call, such as when LLCP SAP MAX is used as SAP. This can lead to a denial of service (NULL pointer dereference and BUG).

Recommendations For Linux kernel versions prior to 5.12.10, update to version 5.12.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the getsockname() function and the bind() call in the net/nfc/llcp sock.c component to minimize the risk of exploitation.