A race condition vulnerability in the Linux kernel NFC subsystem could lead to memory corruption and potential system instability or unauthorized access.

This is a race condition (CWE-362) occurring in the nci_data_exchange_complete function. The flaw allows concurrent calls from nci_close_device and nci_rx_work to trigger a double sock_put operation, causing a reference count underflow and freeing a socket while it is still in use by the kernel.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation could lead to kernel-level memory corruption, which may result in system crashes, denial of service, or potentially arbitrary code execution by an attacker with adjacent network access.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or later as appropriate for your distribution.

Proactive Monitoring: Monitor system logs for kernel panics or unexplained crashes related to the NFC subsystem or socket operations.

Compensating Controls: Disable the NFC subsystem at the kernel module level if it is not required for production operations to eliminate the attack surface.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to kernel stability and security. Administrators should prioritize patching the kernel across all impacted environments to prevent potential memory-based attacks. Applying the vendor-provided security updates is the only definitive way to resolve the underlying race condition.