CVE-2026-90225 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.

Is your site exposed to CVE-2026-90225?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/156e65bd29307f5053835bff60bc1ba342fa010f https://git.kernel.org/stable/c/2d8ac24565be85bf56580b87bf1b874d35625eb5 https://git.kernel.org/stable/c/36812527052c5bfb1ec6c1e292d67a5bf76b750f https://git.kernel.org/stable/c/56fd158fef20268f48db6cdfe5d722e930134eda https://git.kernel.org/stable/c/8ba8cec0586727cc135ca4827921fc7b52946d71 https://git.kernel.org/stable/c/d1b73962675cdc5a58e2707e25b548d8b495fde0 https://git.kernel.org/stable/c/ed5240bab3468988077fe8bf29b935eaecc9ff89 https://git.kernel.org/stable/c/fe65727a4a21b11c18eebae1338482767a897b76

Frequently Asked Questions

What is CVE-2026-90225? +

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-90225? +

CVE-2026-90225 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0018, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-90225? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-90225