CVE-2026-90225

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90225
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90225.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90225
Downstream
Published
2026-09-17T16:07:34Z
Modified
2026-09-19T03:46:52Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
Details

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound.

Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90225.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7
Fixed
56fd158fef20268f48db6cdfe5d722e930134eda
Fixed
8ba8cec0586727cc135ca4827921fc7b52946d71
Fixed
ed5240bab3468988077fe8bf29b935eaecc9ff89
Fixed
fe65727a4a21b11c18eebae1338482767a897b76
Fixed
2d8ac24565be85bf56580b87bf1b874d35625eb5
Fixed
156e65bd29307f5053835bff60bc1ba342fa010f
Fixed
d1b73962675cdc5a58e2707e25b548d8b495fde0
Fixed
36812527052c5bfb1ec6c1e292d67a5bf76b750f

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90225.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.10.0
Fixed
5.10.270
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.221
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.188
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.157
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.52
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90225.json"