{"id":"CVE-2026-98581","title":"kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (CVE-2026-98581)","summary":"A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. When handling specific disconnection packets, the kernel fails to properly lock and unlink sockets before updating t…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-413","vendor":"Red Hat","product":"Linux","affected":["Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f < dd2d24add86b3b63cd87cf2feff98ae119ba19a6","Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f < 812731dd8511f5768f4ff279b3c18d85cd21da4b","Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f < dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08","Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f < c1e9ed52a6697354366dddf190fbacee8ed2f7c5","Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f < 7fb2c0eeb79bfad64065f539a453138abd0edda6","Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f < b94cf09720543cc34256c7aa88f8059cbe7c0419","Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f < 320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1","Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f < bf1460acdf8cf5a07c819f59785d40f20d113099","Linux 3.6"],"published":"2026-10-18","updated":"2026-10-20","sourceUpdated":"2026-10-20T03:58:01+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98581.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98581.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98581"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554913"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98581"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98581"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98581.mbox"},{"url":"https://git.kernel.org/stable/c/dd2d24add86b3b63cd87cf2feff98ae119ba19a6"},{"url":"https://git.kernel.org/stable/c/812731dd8511f5768f4ff279b3c18d85cd21da4b"},{"url":"https://git.kernel.org/stable/c/dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08"},{"url":"https://git.kernel.org/stable/c/c1e9ed52a6697354366dddf190fbacee8ed2f7c5"},{"url":"https://git.kernel.org/stable/c/7fb2c0eeb79bfad64065f539a453138abd0edda6"},{"url":"https://git.kernel.org/stable/c/b94cf09720543cc34256c7aa88f8059cbe7c0419"},{"url":"https://git.kernel.org/stable/c/320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1"},{"url":"https://git.kernel.org/stable/c/bf1460acdf8cf5a07c819f59785d40f20d113099"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00216,"epssPercentile":0.11984,"ingestedAt":"2026-10-18T15:45:12.253Z","slug":"CVE-2026-98581","body":"## Overview\n\nA flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. When handling specific disconnection packets, the kernel fails to properly lock and unlink sockets before updating their state, leading to internal socket list corruption. A local user can exploit this flaw through concurrent socket operations to continuously leak kernel memory, ultimately causing system resource exhaustion and a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98581.json)\n\n**kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225761,"id":"CVE-2026-98581","ts":1792498444803,"field":"cvss","old":null,"new":"4.7"},{"seq":225760,"id":"CVE-2026-98581","ts":1792498444803,"field":"severity","old":"none","new":"medium"}]}