CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's NFC (Near Field Communication) subsystem, specifically in the handling of socket options for LLCP (Logical Link Control Protocol) sockets. An attacker could exploit a race condition during socket binding to dereference a freed pointer, potentially leading to memory corruption or system instability. Organizations using Linux-based systems with NFC capabilities should prioritize addressing this vulnerability to mitigate risks associated with potential exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.