CVE-2026-98581

Что произошло

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() nfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still linked on local->connecting_sockets: it looks the socket up with nfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and returns, without taking the socket lock and without unlinking the socket from the connecting_sockets list. llcp_sock_release() selects the list to unlink from by sk_state: a socket in LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the sockets list. Because recv_dm left the socket physically on connecting_sockets but in the LLCP_CLOSED state, release() takes the else branch and calls nfc_llcp_sock_unlink(&local->sockets, sk). That runs sk_del_node_init() while holding sockets.lock, i.e. it removes the socket from the connecting_sockets hlist under the wrong lock. A concurrent connect() linking another socket onto connecting_sockets under connecting_sockets.lock then mutates the same hlist unserialized, which corrupts the list and desyncs the sk_add_node()/sk_del_node_init() sock_hold()/__sock_put() pairing. An unprivileged local process holding LLCP sockets, with the DM supplied by the remote peer over an established LLCP link, can drive this to leak kernel sockets without bound (the mis-decrement goes through the non-freeing __sock_put() path, so the object is never released), leading to memory exhaustion / DoS. This is the same class of bug that was fixed in the sibling handler nfc_llcp_recv_cc() by commit b493ea2765cc ("nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()"); recv_dm did not receive the equivalent fix. Fix it the same way: take lock_sock(), re-check that the socket is still hashed (release() may have won the race), and for the NOBOUND/REJ case unlink it from connecting_sockets before moving it to LLCP_CLOSED. The unlink drops the connecting_sockets membership reference via sk_del_node_init(), leaving the socket unhashed, so the later nfc_llcp_sock_unlink() in llcp_sock_release() becomes a no-op and no double put occurs.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
  "lessThan": "dd2d24add86b3b63cd87cf2feff98ae119ba19a6",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
  "lessThan": "812731dd8511f5768f4ff279b3c18d85cd21da4b",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
  "lessThan": "dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
  "lessThan": "c1e9ed52a6697354366dddf190fbacee8ed2f7c5",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
  "lessThan": "7fb2c0eeb79bfad64065f539a453138abd0edda6",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
  "lessThan": "b94cf09720543cc34256c7aa88f8059cbe7c0419",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
  "lessThan": "320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
  "lessThan": "bf1460acdf8cf5a07c819f59785d40f20d113099",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "3.6"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "3.6",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "5.10.271",
  "versionType": "semver",
  "lessThanOrEqual": "5.10.*"
}

{
  "status": "unaffected",
  "version": "5.15.222",
  "versionType": "semver",
  "lessThanOrEqual": "5.15.*"
}

{
  "status": "unaffected",
  "version": "6.1.189",
  "versionType": "semver",
  "lessThanOrEqual": "6.1.*"
}

{
  "status": "unaffected",
  "version": "6.6.158",
  "versionType": "semver",
  "lessThanOrEqual": "6.6.*"
}

{
  "status": "unaffected",
  "version": "6.12.112",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.55",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.9",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:46.228175+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T20:13:06.455743+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T20:13:06.455743+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T20:13:06.455743+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:46.228175+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T20:13:06.455743+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены03.11.2026, 00:15
2. Данные обновлены02.11.2026, 00:13
3. Данные обновлены31.10.2026, 12:00
4. Данные обновлены29.10.2026, 12:47
5. Опубликована28.10.2026, 23:13

Личная заметка и статус

Другие CVE того же продукта