Linux Kernel NFC LLCP Socket Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's NFC LLCP socket handling. The issue arises in the `llcp_sock_release()` function, which improperly unlinks sockets from the local sockets list without considering their connection state. This oversight can lead to a use-after-free condition, as sockets in the connecting state are not correctly managed. The vulnerability affects the Linux kernel stable group.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, potentially allowing for memory corruption or arbitrary code execution.

Reproduction

The vulnerability can be reproduced by creating a non-blocking NFC LLCP socket connection and then releasing the socket before the connection is fully established. This will leave the socket in a 'connecting' state, causing the `llcp_sock_release()` function to unlink it from the wrong list, which can lead to a use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel stable branch, where this vulnerability has been addressed.