HIGH
nci DataExchange Race
CVE-2026-90224
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in nci_data_exchange_complete nci_close_device() and nci_rx_work can both call nci_data_exchange_complete() concurrently. After commit 4527025d440ce8 ("nfc: nci: fix circular locking dependency in nci_close_device") moved flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock), rx_work is no longer serialized with the explicit completion call in the close path. Both callers read the non-NULL callback pointer and invoke rawsock_data_exchange_complete(), which calls sock_put() -- but only one sock_hold() was taken, so the second sock_put() underflows the refcount and frees the socket while it is still in use. Replace the bare clear_bit(NCI_DATA_EXCHANGE) with test_and_clear_bit() so that only the first caller proceeds to invoke the callback.
02KernelScan AI Analysis
Risk summary
A local attacker with access to an NFC device can trigger a race between device close and data reception that causes a socket reference count underflow, leading to a use-after-free. This can result in kernel memory corruption, privilege escalation, or a system crash. Exploitation requires NFC hardware to be present and winning a narrow race window.
Vulnerability analysis
A race condition exists in the NFC data exchange completion path: when a device is closed while incoming data is still being processed, both the close path and the incoming-data path can finish the exchange. Each path releases the socket, but only one hold was ever placed on it, so the second release frees the socket while it is still in use. The fix ensures only the first path to claim completion actually finishes the exchange; the second sees it is already done and exits early. An attacker with access to NFC hardware can reach this by starting a data exchange and closing the device at the same time data arrives.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15.203 | 5.15.221 | 588ccd19a6e6 |
| 6.12 | 6.12.80 | 6.12.110 | bfdf412208fe |
| 6.18 | 6.18.21 | 6.18.52 | ba4c776af3dc |
| mainline | — | 7.3-rc1 | — |
| 5.10 | 5.10.253 | 5.10.270 | 3f0758327340 |
| 6.6 | 6.6.131 | 6.6.157 | 9030a1bbe2c6 |
| 6.1 | 6.1.168 | 6.1.188 | cf646a9f5554 |
| 7.2 | — | 7.2.6 | 8265a626cc14 |
| 6.19 | 6.19.11 | 6.20 | ee08414d78b8 |
| cip/6.12 | — | 6.12.111-cip32 | bfdf412208fe |