CVE-2026-90224: Linux

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in nci_data_exchange_complete nci_close_device() and nci_rx_work can both call nci_data_exchange_complete() concurrently. After commit 4527025d440ce8 ("nfc: nci: fix circular locking dependency in nci_close_device") moved flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock), rx_work is no longer serialized with the explicit completion call in the close path. Both callers read the non-NULL callback pointer and invoke rawsock_data_exchange_complete(), which calls sock_put() -- but only one sock_hold() was taken, so the second sock_put() underflows the refcount and frees the socket while it is still in use. Replace the bare clear_bit(NCI_DATA_EXCHANGE) with test_and_clear_bit() so that only the first caller proceeds to invoke the callback.

Affected products

• Linux Linux: from 5.10.253, before 5.10.270 (fixed in 5.10.270); from 5.15.203, before 5.15.221 (fixed in 5.15.221); from 6.1.168, before 6.1.188 (fixed in 6.1.188); from 6.6.131, before 6.6.157 (fixed in 6.6.157); from 6.12.80, before 6.12.110 (fixed in 6.12.110); from 6.18.21, before 6.18.52 (fixed in 6.18.52); …

Published 2026-09-17. Last modified 2026-09-18.