CVE-2026-90225

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the NFC LLCP module. The function nfc llcp getsockopt() reads the llcp sock->local pointer before acquiring the socket lock via lock sock(sk). Simultaneously, llcp sock bind() can modify or clear this pointer under the same lock. If getsockopt() observes the pointer and then blocks on the lock while bind() fails and frees the nfc llcp local object, a use-after-free scenario occurs when getsockopt() eventually dereferences the freed pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.