CVE-2026-90225
Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.
How to fix
- Linux Linux56fd158fef20268f48db6cdfe5d722e930134eda, 8ba8cec0586727cc135ca4827921fc7b52946d71, ed5240bab3468988077fe8bf29b935eaecc9ff89, fe65727a4a21b11c18eebae1338482767a897b76, 2d8ac24565be85bf56580b87bf1b874d35625eb5, 156e65bd29307f5053835bff60bc1ba342fa010f, d1b73962675cdc5a58e2707e25b548d8b495fde0, 36812527052c5bfb1ec6c1e292d67a5bf76b750f or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 ≤ v < 56fd158fef20268f48db6cdfe5d722e930134eda, 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 ≤ v < 8ba8cec0586727cc135ca4827921fc7b52946d71, 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 ≤ v < ed5240bab3468988077fe8bf29b935eaecc9ff89, 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 ≤ v < fe65727a4a21b11c18eebae1338482767a897b76, 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 ≤ v < 2d8ac24565be85bf56580b87bf1b874d35625eb5, 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 ≤ v < 156e65bd29307f5053835bff60bc1ba342fa010f, 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 ≤ v < d1b73962675cdc5a58e2707e25b548d8b495fde0, 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 ≤ v < 36812527052c5bfb1ec6c1e292d67a5bf76b750f, 3.10 | 56fd158fef20268f48db6cdfe5d722e930134eda, 8ba8cec0586727cc135ca4827921fc7b52946d71, ed5240bab3468988077fe8bf29b935eaecc9ff89, fe65727a4a21b11c18eebae1338482767a897b76, 2d8ac24565be85bf56580b87bf1b874d35625eb5, 156e65bd29307f5053835bff60bc1ba342fa010f, d1b73962675cdc5a58e2707e25b548d8b495fde0, 36812527052c5bfb1ec6c1e292d67a5bf76b750f |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.