Critical Race Condition in Linux Kernel NFC Module - CVE-2026-90224
Summary
DEBIAN-CVE-2026-90224: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in nci_data_exchange_complete nci_close_device() and nci_rx_work can both call nci_data_exchange_complete() concurr... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including networking, file management, and device control. The kernel's NFC (Near Field Communication) module facilitates communication between devices over short distances. However, it is susceptible to vulnerabilities that can compromise system stability and security.
Vulnerability Detail
In the Linux kernel, a race condition vulnerability has been identified in the NFC module, specifically in the nci_data_exchange_complete function. This issue arises when both nci_close_device() and nci_rx_work attempt to call nci_data_exchange_complete() simultaneously. Due to a change in the locking mechanism, both functions can read a non-NULL callback pointer and invoke rawsock_data_exchange_complete(), leading to an underflow in the socket reference count. This can result in the socket being freed while still in use, potentially causing system crashes or data corruption.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the NFC functionalities until the package is updated. This can be done by disabling NFC services in the system settings or by not utilizing applications that rely on NFC communication.
Conclusion
CVE-2026-90224 represents a significant vulnerability in the Linux kernel's NFC module, leading to potential system instability. Users are urged to update their systems promptly to mitigate risks associated with this vulnerability. Temporary workarounds are available, but the best course of action is to apply the necessary patches.
See every vulnerability recorded for linux →
FAQ
CVE-2026-90224 is a vulnerability in the Linux kernel's NFC module that can lead to a race condition, potentially causing system instability.
This vulnerability can lead to crashes or data corruption due to improper handling of socket references in the NFC module.
If you are using a version of the Linux kernel that is affected by this vulnerability, your system may be at risk. It is advisable to check for updates.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities like CVE-2026-90224.
If an immediate update is not possible, consider disabling NFC functionalities as a temporary measure to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
