CVE-2026-90225

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.

Is your site exposed to CVE-2026-90225?

Run a free security scan — no signup, results in seconds.

References

Other References

https://git.kernel.org/stable/c/156e65bd29307f5053835bff60bc1ba342fa010f https://git.kernel.org/stable/c/2d8ac24565be85bf56580b87bf1b874d35625eb5 https://git.kernel.org/stable/c/36812527052c5bfb1ec6c1e292d67a5bf76b750f https://git.kernel.org/stable/c/56fd158fef20268f48db6cdfe5d722e930134eda https://git.kernel.org/stable/c/8ba8cec0586727cc135ca4827921fc7b52946d71 https://git.kernel.org/stable/c/d1b73962675cdc5a58e2707e25b548d8b495fde0 https://git.kernel.org/stable/c/ed5240bab3468988077fe8bf29b935eaecc9ff89 https://git.kernel.org/stable/c/fe65727a4a21b11c18eebae1338482767a897b76

Frequently Asked Questions

What is CVE-2026-90225? +

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.

How do I check if I'm vulnerable to CVE-2026-90225? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-90225

Description

References

Other References

Frequently Asked Questions

Don't wait for an exploit