A race condition in the Linux kernel NFC LLCP subsystem exposes systems to potential memory corruption and unauthorized code execution.

This is a use-after-free vulnerability occurring in the NFC LLCP connection state machine. An attacker can trigger this condition by racing a connection acceptance packet against a socket release, which may result in the kernel operating on freed memory. The attack vector is adjacent (AV:A), meaning the attacker must be in the same network segment.

Successful exploitation of this flaw can lead to a kernel panic, resulting in system downtime, or potentially allow for privilege escalation and unauthorized access to sensitive data. Given the CVSS score of 8.8, this represents a high-severity risk to system integrity and availability.

Immediate Action: Update your Linux kernel to the versions listed in the OSV fixed packages (5.10.259, 5.15.210, 6.1.176, or 6.6.143) or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or crash reports that may indicate memory corruption events related to the NFC subsystem.

Compensating Controls: If patching is not immediately feasible, disable the NFC LLCP module if it is not required for system functionality to eliminate the attack surface.

Public Exploit Available: exploit_available (unknown)

This vulnerability presents a significant risk to kernel stability and security. Administrators should prioritize the deployment of kernel updates as part of standard maintenance cycles, ensuring that affected systems are brought to a patched state to prevent potential exploitation.