7.5

CVE-2026-90224

nfc: nci: fix double completion race in nci_data_exchange_complete

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix double completion race in nci_data_exchange_complete

nci_close_device() and nci_rx_work can both call
nci_data_exchange_complete() concurrently.  After commit 4527025d440ce8
("nfc: nci: fix circular locking dependency in nci_close_device") moved
flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock),
rx_work is no longer serialized with the explicit completion call in the
close path.  Both callers read the non-NULL callback pointer and invoke
rawsock_data_exchange_complete(), which calls sock_put() -- but only one
sock_hold() was taken, so the second sock_put() underflows the refcount
and frees the socket while it is still in use.

Replace the bare clear_bit(NCI_DATA_EXCHANGE) with
test_and_clear_bit() so that only the first caller proceeds to invoke
the callback.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 7ed00a3edc8597fe2333f524401e2889aa1b5edf
Version < 3f075832734005310740d148d1cf1c1e792ebdca
Status affected
Version 5eef9ebec7f5738f12cadede3545c05b34bf5ac3
Version < 588ccd19a6e69eca72d54608c3ab3b45709b2305
Status affected
Version ca54e904a071aa65ef3ad46ba42d51aaac6b73b4
Version < cf646a9f5554bc07d6ccb59c327812b3a0c6a368
Status affected
Version eb435d150ca74b4d40f77f1a2266f3636ed64a79
Version < 9030a1bbe2c6b1e3e54cef462d159b5248f09fd2
Status affected
Version 1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289
Version < bfdf412208fea7fc0d5b32d68a35b25261917393
Status affected
Version d89b74bf08f067b55c03d7f999ba0a0e73177eb3
Version < ba4c776af3dc21ed04e315e6545e99703bb1b53a
Status affected
Version 4527025d440ce84bf56e75ce1df2e84cb8178616
Version < ee08414d78b851e3d1856d6e4d631939b01a1bbe
Status affected
Version 4527025d440ce84bf56e75ce1df2e84cb8178616
Version < 8265a626cc14a48e46e6dc8c47667e72b4232ac2
Status affected
Version 09143c0e8f3b03517e6233aad42f45c794d8df8e
Status affected
Version 5.10.253
Version < 5.10.270
Status affected
Version 5.15.203
Version < 5.15.221
Status affected
Version 6.1.168
Version < 6.1.188
Status affected
Version 6.6.131
Version < 6.6.157
Status affected
Version 6.12.80
Version < 6.12.110
Status affected
Version 6.18.21
Version < 6.18.52
Status affected
Version 6.19.11
Version < 6.20
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 7.0
Status affected
Version 0
Version < 7.0
Status unaffected
Version <= 5.10.*
Version 5.10.270
Status unaffected
Version <= 5.15.*
Version 5.15.221
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.52
Status unaffected
Version <= 7.2.*
Version 7.2.6
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.227
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.5 1.6 5.9
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/3f075832734005310740d148d1cf1c1e792ebdca
https://git.kernel.org/stable/c/588ccd19a6e69eca72d54608c3ab3b45709b2305
https://git.kernel.org/stable/c/cf646a9f5554bc07d6ccb59c327812b3a0c6a368
https://git.kernel.org/stable/c/9030a1bbe2c6b1e3e54cef462d159b5248f09fd2
https://git.kernel.org/stable/c/bfdf412208fea7fc0d5b32d68a35b25261917393
https://git.kernel.org/stable/c/ba4c776af3dc21ed04e315e6545e99703bb1b53a
https://git.kernel.org/stable/c/ee08414d78b851e3d1856d6e4d631939b01a1bbe
https://git.kernel.org/stable/c/8265a626cc14a48e46e6dc8c47667e72b4232ac2