---
id: CVE-2026-98581
title: >-
  kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
  (CVE-2026-98581)
summary: >-
  A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical
  Link Control Protocol (LLCP) implementation. When handling specific
  disconnection packets, the kernel fails to properly lock and unlink sockets
  before updating t…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-413
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f <
    dd2d24add86b3b63cd87cf2feff98ae119ba19a6
  - >-
    Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f <
    812731dd8511f5768f4ff279b3c18d85cd21da4b
  - >-
    Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f <
    dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08
  - >-
    Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f <
    c1e9ed52a6697354366dddf190fbacee8ed2f7c5
  - >-
    Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f <
    7fb2c0eeb79bfad64065f539a453138abd0edda6
  - >-
    Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f <
    b94cf09720543cc34256c7aa88f8059cbe7c0419
  - >-
    Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f <
    320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1
  - >-
    Linux >= a69f32af86e389dd232b1bb2269e202c1bfcc60f <
    bf1460acdf8cf5a07c819f59785d40f20d113099
  - Linux 3.6
published: '2026-10-18'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T03:58:01+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98581.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98581.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98581'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554913'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98581'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98581'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98581.mbox
  - url: 'https://git.kernel.org/stable/c/dd2d24add86b3b63cd87cf2feff98ae119ba19a6'
  - url: 'https://git.kernel.org/stable/c/812731dd8511f5768f4ff279b3c18d85cd21da4b'
  - url: 'https://git.kernel.org/stable/c/dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08'
  - url: 'https://git.kernel.org/stable/c/c1e9ed52a6697354366dddf190fbacee8ed2f7c5'
  - url: 'https://git.kernel.org/stable/c/7fb2c0eeb79bfad64065f539a453138abd0edda6'
  - url: 'https://git.kernel.org/stable/c/b94cf09720543cc34256c7aa88f8059cbe7c0419'
  - url: 'https://git.kernel.org/stable/c/320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1'
  - url: 'https://git.kernel.org/stable/c/bf1460acdf8cf5a07c819f59785d40f20d113099'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00216
epssPercentile: 0.11984
ingestedAt: '2026-10-18T15:45:12.253Z'
---

## Overview

A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. When handling specific disconnection packets, the kernel fails to properly lock and unlink sockets before updating their state, leading to internal socket list corruption. A local user can exploit this flaw through concurrent socket operations to continuously leak kernel memory, ultimately causing system resource exhaustion and a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98581.json)

**kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.