{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.190-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  nfc: llcp: Fix race condition in accept_queue lifecycle  In nfc_llcp_socket_release(), sockets and listener accept queues are walked under the local sockets rwlock and bh_lock_sock().  However, bh_lock_sock() does not synchronise against process-context lock_sock() held by nfc_llcp_accept_dequeue() during accept().  Because socket_release() does not check sock_owned_by_user(), both paths can concurrently unlink and release the same child socket, resulting in use-after-free or a NULL pointer dereference of child-\u003eparent in nfc_llcp_accept_unlink().  Fix this synchronisation race by having nfc_llcp_socket_release() use process-context lock_sock() instead of bh_lock_sock():  1. Pop sockets from the local sockets list under the write lock using    nfc_llcp_sock_list_pop() so lock_sock() can be acquired without    holding the rwlock.  2. Because lock_sock() can sleep, defer the final release of the    nfc_llcp_local structure to a workqueue (release_work).  This avoids    a sleeping-in-atomic bug when the last local reference is dropped    from softirq context.  Additionally, hold a single device reference    on local from registration until final destruction.  3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent    resurrecting a local object whose teardown has been scheduled.  4. In llcp_sock_accept(), verify that the listener socket state is still    LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if    the listener is closed concurrently.  5. When unlinking unaccepted child sockets during listener release,    unlink them from local-\u003esockets, call sock_orphan(), and drop their    initial sk_alloc creation reference via sock_put().  6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with    a NULL check.",
  "id": "DEBIAN-CVE-2026-98580",
  "modified": "2026-10-19T04:47:43.881391664Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98580"
    }
  ],
  "upstream": [
    "CVE-2026-98580"
  ]
}