CVE-2026-90226 (GCVE-0-2026-90226)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-17 16:07
VLAI
Title
nfc: llcp: avoid userspace overflow on invalid optlen
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfc_llcp_getsockopt() casts optval to (u32 __user *) for put_user(), so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing min_t(u32, len, sizeof(u32)) only clamps the length reported back to userspace; it does not constrain the store. A call with optlen < 4 therefore writes past the user buffer, violating the getsockopt(2) contract for all five supported optnames. Reject any call with optlen < sizeof(u32) up front. 'len' is int, so a plain size comparison would promote a negative optlen to size_t and slip past the check; an explicit 'len < 0' test is added first to catch negative values before the size compare.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 , < 42859562b7cc4313a84a584f338118edb7087066 (git)
Affected: 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 , < 598dcd53c52f8eeb9dd5382198c03960d5d40fcd (git)
Affected: 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 , < 7e40f2f5e7bc06c3ddef781180ce4f7994176547 (git)
Affected: 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 , < 35573c6cb081af2f4a7caeea291302aca5484526 (git)
Affected: 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 , < b4c5abaea06292e1dddb70eac1b51589b32c77a3 (git)
Affected: 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 , < 8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67 (git)
Affected: 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 , < bd6f1277b62bc1df348ca21739df2bc546fcd493 (git)
Affected: 26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 , < 99985bfa8336fadcc69190ba2dcbd5386af3d661 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/llcp_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "42859562b7cc4313a84a584f338118edb7087066",
              "status": "affected",
              "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
              "versionType": "git"
            },
            {
              "lessThan": "598dcd53c52f8eeb9dd5382198c03960d5d40fcd",
              "status": "affected",
              "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
              "versionType": "git"
            },
            {
              "lessThan": "7e40f2f5e7bc06c3ddef781180ce4f7994176547",
              "status": "affected",
              "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
              "versionType": "git"
            },
            {
              "lessThan": "35573c6cb081af2f4a7caeea291302aca5484526",
              "status": "affected",
              "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
              "versionType": "git"
            },
            {
              "lessThan": "b4c5abaea06292e1dddb70eac1b51589b32c77a3",
              "status": "affected",
              "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
              "versionType": "git"
            },
            {
              "lessThan": "8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67",
              "status": "affected",
              "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
              "versionType": "git"
            },
            {
              "lessThan": "bd6f1277b62bc1df348ca21739df2bc546fcd493",
              "status": "affected",
              "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
              "versionType": "git"
            },
            {
              "lessThan": "99985bfa8336fadcc69190ba2dcbd5386af3d661",
              "status": "affected",
              "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/llcp_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: avoid userspace overflow on invalid optlen\n\nnfc_llcp_getsockopt() casts optval to (u32 __user *) for put_user(), so\nthe kernel always stores 4 bytes regardless of the caller-supplied\noptlen. The existing min_t(u32, len, sizeof(u32)) only clamps the length\nreported back to userspace; it does not constrain the store. A call with\noptlen \u003c 4 therefore writes past the user buffer, violating the\ngetsockopt(2) contract for all five supported optnames.\n\nReject any call with optlen \u003c sizeof(u32) up front. \u0027len\u0027 is int, so a\nplain size comparison would promote a negative optlen to size_t and slip\npast the check; an explicit \u0027len \u003c 0\u0027 test is added first to catch\nnegative values before the size compare."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:07:35.322Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/42859562b7cc4313a84a584f338118edb7087066"
        },
        {
          "url": "https://git.kernel.org/stable/c/598dcd53c52f8eeb9dd5382198c03960d5d40fcd"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e40f2f5e7bc06c3ddef781180ce4f7994176547"
        },
        {
          "url": "https://git.kernel.org/stable/c/35573c6cb081af2f4a7caeea291302aca5484526"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4c5abaea06292e1dddb70eac1b51589b32c77a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd6f1277b62bc1df348ca21739df2bc546fcd493"
        },
        {
          "url": "https://git.kernel.org/stable/c/99985bfa8336fadcc69190ba2dcbd5386af3d661"
        }
      ],
      "title": "nfc: llcp: avoid userspace overflow on invalid optlen",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90226",
    "datePublished": "2026-09-17T16:07:35.322Z",
    "dateReserved": "2026-09-11T19:38:34.794Z",
    "dateUpdated": "2026-09-17T16:07:35.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90226",
      "date": "2026-09-25",
      "epss": "0.0021",
      "percentile": "0.10068"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:05:22.000Z",
      "cve": "CVE-2026-90226",
      "id": "msrc_CVE-2026-90226",
      "initial_release_date": "2026-09-19T01:19:46.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nfc: llcp: avoid userspace overflow on invalid optlen",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90226.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/nfc/llcp_sock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "42859562b7cc4313a84a584f338118edb7087066",
                    "status": "affected",
                    "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "598dcd53c52f8eeb9dd5382198c03960d5d40fcd",
                    "status": "affected",
                    "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7e40f2f5e7bc06c3ddef781180ce4f7994176547",
                    "status": "affected",
                    "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35573c6cb081af2f4a7caeea291302aca5484526",
                    "status": "affected",
                    "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b4c5abaea06292e1dddb70eac1b51589b32c77a3",
                    "status": "affected",
                    "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67",
                    "status": "affected",
                    "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd6f1277b62bc1df348ca21739df2bc546fcd493",
                    "status": "affected",
                    "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "99985bfa8336fadcc69190ba2dcbd5386af3d661",
                    "status": "affected",
                    "version": "26fd76cab2e61cedc5c25f7151fb31b57ddc53c7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/nfc/llcp_sock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.10"
                  },
                  {
                    "lessThan": "3.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: avoid userspace overflow on invalid optlen\n\nnfc_llcp_getsockopt() casts optval to (u32 __user *) for put_user(), so\nthe kernel always stores 4 bytes regardless of the caller-supplied\noptlen. The existing min_t(u32, len, sizeof(u32)) only clamps the length\nreported back to userspace; it does not constrain the store. A call with\noptlen \u003c 4 therefore writes past the user buffer, violating the\ngetsockopt(2) contract for all five supported optnames.\n\nReject any call with optlen \u003c sizeof(u32) up front. \u0027len\u0027 is int, so a\nplain size comparison would promote a negative optlen to size_t and slip\npast the check; an explicit \u0027len \u003c 0\u0027 test is added first to catch\nnegative values before the size compare."
          }
        ],
        "id": "CVE-2026-90226",
        "lastModified": "2026-09-17T17:17:18.270",
        "metrics": {},
        "published": "2026-09-17T17:17:18.270",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/35573c6cb081af2f4a7caeea291302aca5484526"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/42859562b7cc4313a84a584f338118edb7087066"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/598dcd53c52f8eeb9dd5382198c03960d5d40fcd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7e40f2f5e7bc06c3ddef781180ce4f7994176547"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/99985bfa8336fadcc69190ba2dcbd5386af3d661"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b4c5abaea06292e1dddb70eac1b51589b32c77a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bd6f1277b62bc1df348ca21739df2bc546fcd493"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.