Improper locking in Linux kernel - CVE-2026-98581
Published: October 22, 2026
Vulnerability identifier: #VU156884
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98581
CWE-ID: CWE-667
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service by exhausting kernel memory through unbounded socket leaks.
The vulnerability exists due to improper locking and inconsistent socket list membership in the Linux kernel NFC LLCP nfc_llcp_recv_dm() function when handling DM(NOBOUND) or DM(REJ) messages. A local user can race socket release against concurrent connection operations while a remote peer supplies these messages over an established LLCP link to corrupt the connecting socket list, disrupt reference counting, and leak kernel sockets until memory is exhausted.
Affected software
Linux kernel
How to mitigate CVE-2026-98581
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1
- https://git.kernel.org/stable/c/7fb2c0eeb79bfad64065f539a453138abd0edda6
- https://git.kernel.org/stable/c/812731dd8511f5768f4ff279b3c18d85cd21da4b
- https://git.kernel.org/stable/c/b94cf09720543cc34256c7aa88f8059cbe7c0419
- https://git.kernel.org/stable/c/bf1460acdf8cf5a07c819f59785d40f20d113099
- https://git.kernel.org/stable/c/c1e9ed52a6697354366dddf190fbacee8ed2f7c5
- https://git.kernel.org/stable/c/dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08
- https://git.kernel.org/stable/c/dd2d24add86b3b63cd87cf2feff98ae119ba19a6