CVE-2026-90224 (CVSS 7.5)

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in nci_data_exchange_complete nci_close_device() and nci_rx_work can both call nci_data_exchange_complete() concurrently. After commit 4527025d440ce8 ("nfc: nci: fix circular locking dependency in nci_close_device") moved flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock), rx_work is no longer serialized with the explicit completion call in the close path. Both callers read the non-NULL callback pointer and invoke rawsock_data_exchange_complete(), which calls sock_put() -- but only one sock_hold() was taken, so the second sock_put() underflows the refcount and frees the socket while it is still in use. Replace the bare clear_bit(NCI_DATA_EXCHANGE) with test_and_clear_bit() so that only the first caller proceeds to invoke the callback.

Is your site exposed to CVE-2026-90224?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0036

Probability of exploitation

0.28%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/3f075832734005310740d148d1cf1c1e792ebdca https://git.kernel.org/stable/c/588ccd19a6e69eca72d54608c3ab3b45709b2305 https://git.kernel.org/stable/c/8265a626cc14a48e46e6dc8c47667e72b4232ac2 https://git.kernel.org/stable/c/9030a1bbe2c6b1e3e54cef462d159b5248f09fd2 https://git.kernel.org/stable/c/ba4c776af3dc21ed04e315e6545e99703bb1b53a https://git.kernel.org/stable/c/bfdf412208fea7fc0d5b32d68a35b25261917393 https://git.kernel.org/stable/c/cf646a9f5554bc07d6ccb59c327812b3a0c6a368 https://git.kernel.org/stable/c/ee08414d78b851e3d1856d6e4d631939b01a1bbe

Frequently Asked Questions

What is CVE-2026-90224? +

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in nci_data_exchange_complete nci_close_device() and nci_rx_work can both call nci_data_exchange_complete() concurrently. After commit 4527025d440ce8 ("nfc: nci: fix circular locking dependency in nci_close_device") moved flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock), rx_work is no longer serialized with the explicit completion call in the close path. Both callers read the non-NULL callback pointer and invoke rawsock_data_exchange_complete(), which calls sock_put() -- but only one sock_hold() was taken, so the second sock_put() underflows the refcount and frees the socket while it is still in use. Replace the bare clear_bit(NCI_DATA_EXCHANGE) with test_and_clear_bit() so that only the first caller proceeds to invoke the callback. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-90224? +

CVE-2026-90224 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0036, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-90224? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-90224