CVE-2026-90224 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems with NFC capabilities, should assess exposure and apply the patch to prevent potential issues. This includes reviewing and updating custom kernel modules, verifying socket usage and reference counting, and monitoring Linux kernel updates for potential backports of the fix.

Why it matters

CVE-2026-90224 is a high-severity vulnerability in the Linux kernel's NFC subsystem, requiring prompt attention from developers and users to prevent potential issues. The vulnerability has been addressed by replacing the `clear_bit` operation with `test_and_clear_bit` to ensure only one caller proceeds to invoke the callback.

• Potential socket use-after-free and reference count underflow
• Verification of socket usage and reference counting in custom kernel modules
• Assessment of exposure based on specific use cases and configurations
• Monitoring Linux kernel updates for potential backports of the fix

Technical summary

The vulnerability is caused by a double completion race condition in the `nci_data_exchange_complete` function, which can lead to a reference count underflow and premature socket freeing. The issue arises from concurrent calls to `nci_data_exchange_complete` by `nci_close_device` and `nci_rx_work`. This vulnerability affects Linux kernel developers and maintainers, as well as users of Linux-based systems with NFC capabilities. The fix involves replacing the `clear_bit` operation with `test_and_clear_bit` to ensure only one caller proceeds to invoke the callback.

Defensive priority

High

Recommended defensive actions

• Review and apply the kernel patch to address the double completion race condition
• Monitor Linux kernel updates for potential backports of the fix
• Assess exposure based on specific use cases and configurations
• Verify socket usage and reference counting in custom kernel modules
• Perform a thorough review of the NFC subsystem implementation
• Update documentation to reflect changes in the kernel patch
• Conduct a code audit to identify similar issues

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected components. However, specific version information and exploitation details are not provided, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.