https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 01:54:03 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90225 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfc: llcp: read llcp_sock-&gt;local under the socket lock in getsockopt</p> <p>nfc_llcp_getsockopt() read llcp_sock-&gt;local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock-&gt;local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound.</p> <p>Move the llcp_sock-&gt;local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfc: llcp: read llcp_sock-&gt;local under the socket lock in getsockopt</p> <p>nfc_llcp_getsockopt() read llcp_sock-&gt;local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock-&gt;local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound.</p> <p>Move the llcp_sock-&gt;local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.</p> https://vulnerability.circl.lu/vuln/cve-2026-90225