CVE-2026-98580: Linux Kernel NFC LLCP Race Condition

CVE-2026-98580 Overview

CVE-2026-98580 is a race condition in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) subsystem. The flaw lives in nfc_llcp_socket_release(), which walks sockets and listener accept queues under bh_lock_sock(). That lock does not synchronize against process-context lock_sock() held by nfc_llcp_accept_dequeue() during an accept() call. Two concurrent paths can therefore unlink and release the same child socket, producing a use-after-free or a NULL pointer dereference of child->parent in nfc_llcp_accept_unlink().

Critical Impact
Local attackers interacting with the NFC LLCP stack can trigger a kernel use-after-free or NULL pointer dereference, leading to denial of service or potential privilege escalation on affected Linux systems.

Affected Products

Linux kernel versions containing the vulnerable nfc/llcp socket release path
Linux distributions shipping kernels prior to the stable commits referenced below
Systems with the CONFIG_NFC and LLCP support compiled in or loadable

Discovery Timeline

2026-10-18 - CVE-2026-98580 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98580

Vulnerability Analysis

The vulnerability is a classic kernel race condition between softirq and process contexts. nfc_llcp_socket_release() iterates local sockets and listener accept queues while holding the local sockets rwlock and bh_lock_sock(). The accept path, nfc_llcp_accept_dequeue(), instead takes the process-context lock_sock() during accept(). Because socket_release() never checks sock_owned_by_user(), both code paths can race to unlink and release the same child socket.

The consequence is a use-after-free on the released child socket or a NULL pointer dereference when nfc_llcp_accept_unlink() subsequently touches child->parent. A secondary sleeping-in-atomic bug exists when the last nfc_llcp_local reference is dropped from softirq context, because lock_sock() can sleep.

Root Cause

The root cause is mismatched locking primitives across contexts handling the same socket objects. bh_lock_sock() provides mutual exclusion against bottom-half handlers but offers no synchronization against process-context code holding lock_sock(). Combined with the lack of a sock_owned_by_user() guard in the release path, concurrent unlink operations on the same accept-queue entry become possible [CWE-362, Race Condition].

Attack Vector

Exploitation requires a local attacker able to open and manipulate NFC LLCP sockets, typically through the AF_NFC socket family. By racing accept() on a listening LLCP socket against teardown of the parent local object, an attacker can drive both release paths into the same child socket. Successful races yield a kernel memory corruption primitive that can crash the host or be shaped into privilege escalation.

No public proof-of-concept exploitation code is referenced in the advisory. The vulnerability was addressed in the kernel source; see the stable commits in the references for technical details of the fix.

Detection Methods for CVE-2026-98580

Indicators of Compromise

Kernel oops or panic messages referencing nfc_llcp_accept_unlink, nfc_llcp_socket_release, or nfc_llcp_accept_dequeue in dmesg or /var/log/kern.log
NULL pointer dereference backtraces inside the net/nfc/llcp_sock.c or net/nfc/llcp_core.c code paths
Unexpected processes opening AF_NFC sockets on systems that do not use NFC hardware

Detection Strategies

Monitor kernel ring buffer and audit logs for repeated LLCP-related crashes, which can indicate exploitation attempts or instability from the race
Alert on execution of binaries that invoke socket(AF_NFC, ...) on servers and endpoints where NFC usage is not expected
Use KASAN-enabled kernels in test environments to surface the use-after-free deterministically during fuzzing

Monitoring Recommendations

Forward kernel crash telemetry and kdump artifacts to a central analytics platform for correlation across hosts
Track loaded kernel modules and flag unexpected loads of nfc and nfc_digital on production systems
Baseline AF_NFC socket activity per host so anomalous bursts of accept() calls on LLCP sockets become visible

How to Mitigate CVE-2026-98580

Immediate Actions Required

Apply the stable kernel updates containing the referenced fix commits as soon as vendor packages become available
Blacklist the nfc and related LLCP modules on systems that do not require NFC functionality, preventing load-on-demand exposure
Restrict the ability of unprivileged users to open AF_NFC sockets using seccomp profiles or LSM policy where feasible

Patch Information

The fix reworks nfc_llcp_socket_release() to use process-context lock_sock() instead of bh_lock_sock(), pops sockets from the local list via nfc_llcp_sock_list_pop(), defers final nfc_llcp_local destruction to a workqueue (release_work), switches nfc_llcp_local_get() to kref_get_unless_zero(), revalidates LLCP_LISTEN state in llcp_sock_accept(), properly orphans unaccepted children, and makes nfc_llcp_accept_unlink() idempotent with a NULL parent check. Patch commits are available at Kernel Git Commit 4125682, Kernel Git Commit 53867f6, Kernel Git Commit 54adcab, Kernel Git Commit 7c938aa, Kernel Git Commit c3eef2f, Kernel Git Commit d2093a0, Kernel Git Commit d5e1c92, and Kernel Git Commit da8a077.

Workarounds

Unload the nfc kernel module where NFC is not needed and prevent reload via modprobe blacklist entries
Disable NFC hardware in BIOS or firmware on servers and workstations that ship with but do not use NFC radios
Apply mandatory access control policies that deny the AF_NFC socket family to all unprivileged processes

bash

# Configuration example: prevent NFC LLCP exposure on hosts that do not need it
echo 'blacklist nfc'          | sudo tee /etc/modprobe.d/disable-nfc.conf
echo 'blacklist nfc_digital'  | sudo tee -a /etc/modprobe.d/disable-nfc.conf
echo 'install nfc /bin/true'  | sudo tee -a /etc/modprobe.d/disable-nfc.conf
sudo rmmod nfc_digital nfc 2>/dev/null || true
sudo update-initramfs -u