{
  "cveId": "CVE-2026-98580",
  "url": "https://patchblox.com/security/cve/CVE-2026-98580",
  "summary": "CVE-2026-98580 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2026-98580, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "nfc: llcp: Fix race condition in accept_queue lifecycle",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  nfc: llcp: Fix race condition in accept_queue lifecycle  In nfc_llcp_socket_release(), sockets and listener accept queues are walked under the local sockets rwlock and bh_lock_sock().  However, bh_lock_sock() does not synchronise against process-context lock_sock() held by nfc_llcp_accept_dequeue() during accept().  Because socket_release() does not check sock_owned_by_user(), both paths can concurrently unlink and release the same child socket, resulting in use-after-free or a NULL pointer dereference of child-\u003Eparent in nfc_llcp_accept_unlink().  Fix this synchronisation race by having nfc_llcp_socket_release() use process-context lock_sock() instead of bh_lock_sock():  1. Pop sockets from the local sockets list under the write lock using    nfc_llcp_sock_list_pop() so lock_sock() can be acquired without    holding the rwlock.  2. Because lock_sock() can sleep, defer the final release of the    nfc_llcp_local structure to a workqueue (release_work).  This avoids    a sleeping-in-atomic bug when the last local reference is dropped    from softirq context.  Additionally, hold a single device reference    on local from registration until final destruction.  3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent    resurrecting a local object whose teardown has been scheduled.  4. In llcp_sock_accept(), verify that the listener socket state is still    LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if    the listener is closed concurrently.  5. When unlinking unaccepted child sockets during listener release,    unlink them from local-\u003Esockets, call sock_orphan(), and drop their    initial sk_alloc creation reference via sock_put().  6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with    a NULL check.",
  "published": "2026-10-18T16:17:10Z",
  "severity": "Moderate",
  "cvss": 5.8,
  "epss": 0.00216,
  "epssPercentile": 0.1217,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98580",
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1.150700.17.51.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7_Update_24",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.15.3.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.190-1",
      "fix": "DEBIAN-CVE-2026-98580",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98580",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-98580",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98580",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.9-1",
      "fix": "DEBIAN-CVE-2026-98580",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98580",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.113-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-98580",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98580",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}