Use-after-free in Linux kernel - CVE-2026-98580
Published: October 22, 2026
Vulnerability identifier: #VU156883
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98580
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service by potentially crashing the Linux kernel.
The vulnerability exists due to improper synchronization in the Linux kernel NFC LLCP accept queue lifecycle when socket release and accept operations run concurrently. A local user can trigger overlapping operations that unlink and release the same child socket, causing use-after-free or a NULL pointer dereference in nfc_llcp_accept_unlink() that may crash the kernel.
Affected software
Linux kernel
How to mitigate CVE-2026-98580
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/41256821762a7114906b178826d17098e2fa5992
- https://git.kernel.org/stable/c/53867f6acb1af7f12d6485fa8a2819318f89083b
- https://git.kernel.org/stable/c/54adcabb0f1deef1bdae5fc64779ed6d442721c9
- https://git.kernel.org/stable/c/7c938aad5108382c6ad7453c4b5ee8ae3f3252ed
- https://git.kernel.org/stable/c/c3eef2f988a3db9690369d7cef9a3344dd9788d3
- https://git.kernel.org/stable/c/d2093a0981138876212bc5f473bdbfba0786e064
- https://git.kernel.org/stable/c/d5e1c92d09caed19f2988739695ce611a86ba6f8
- https://git.kernel.org/stable/c/da8a07757383614a8380a0f7dd54749d2687b82e