CVE-2026-98580: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-f48w-jg7j-gjm2
Share
Published
Advisory Summary

CVE-2026-98580 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98580 at a Glance

CVE Identifier CVE-2026-98580
GHSA Identifier GHSA-f48w-jg7j-gjm2
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98580

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98580, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in accept_queue lifecycle In nfc_llcp_socket_release(), sockets and listener accept queues are walked under the local sockets rwlock and bh_lock_sock(). However, bh_lock_sock() does not synchronise against process-context lock_sock() held by nfc_llcp_accept_dequeue() during accept(). Because socket_release() does not check sock_owned_by_user(), both paths can concurrently unlink and release the same child socket, resulting in use-after-free or a NULL pointer dereference of child->parent in nfc_llcp_accept_unlink(). Fix this synchronisation race by having nfc_llcp_socket_release() use process-context lock_sock() instead of bh_lock_sock(): 1. Pop sockets from the local sockets list under the write lock using nfc_llcp_sock_list_pop() so lock_sock() can be acquired without holding the rwlock. 2. Because lock_sock() can sleep, defer the final release of the nfc_llcp_local structure to a workqueue (release_work). This avoids a sleeping-in-atomic bug when the last local reference is dropped from softirq context. Additionally, hold a single device reference on local from registration until final destruction. 3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent resurrecting a local object whose teardown has been scheduled. 4. In llcp_sock_accept(), verify that the listener socket state is still LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if the listener is closed concurrently. 5. When unlinking unaccepted child sockets during listener release, unlink them from local->sockets, call sock_orphan(), and drop their initial sk_alloc creation reference via sock_put(). 6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with a NULL check.

References

NVD — CVE-2026-98580 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98580
git.kernel.org/stable/c/4125682176... WEB
https://git.kernel.org/stable/c/41256821762a7114906b178826d17098e2fa5992
git.kernel.org/stable/c/53867f6acb... WEB
https://git.kernel.org/stable/c/53867f6acb1af7f12d6485fa8a2819318f89083b
git.kernel.org/stable/c/54adcabb0f... WEB
https://git.kernel.org/stable/c/54adcabb0f1deef1bdae5fc64779ed6d442721c9
git.kernel.org/stable/c/7c938aad51... WEB
https://git.kernel.org/stable/c/7c938aad5108382c6ad7453c4b5ee8ae3f3252ed
git.kernel.org/stable/c/c3eef2f988... WEB
https://git.kernel.org/stable/c/c3eef2f988a3db9690369d7cef9a3344dd9788d3
git.kernel.org/stable/c/d2093a0981... WEB
https://git.kernel.org/stable/c/d2093a0981138876212bc5f473bdbfba0786e064
git.kernel.org/stable/c/d5e1c92d09... WEB
https://git.kernel.org/stable/c/d5e1c92d09caed19f2988739695ce611a86ba6f8
git.kernel.org/stable/c/da8a077573... WEB
https://git.kernel.org/stable/c/da8a07757383614a8380a0f7dd54749d2687b82e

Frequently Asked Questions

What is CVE-2026-98580?
CVE-2026-98580 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98580?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98580?
CVE-2026-98580 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98580?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f48w-jg7j-gjm2",
  "modified" : "2026-10-18T18:31:55Z",
  "published" : "2026-10-18T18:31:54Z",
  "aliases" : [ "CVE-2026-98580" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix race condition in accept_queue lifecycle\n\nIn nfc_llcp_socket_release(), sockets and listener accept queues are\nwalked under the local sockets rwlock and bh_lock_sock().  However,\nbh_lock_sock() does not synchronise against process-context lock_sock()\nheld by nfc_llcp_accept_dequeue() during accept().  Because\nsocket_release() does not check sock_owned_by_user(), both paths can\nconcurrently unlink and release the same child socket, resulting in\nuse-after-free or a NULL pointer dereference of child->parent in\nnfc_llcp_accept_unlink().\n\nFix this synchronisation race by having nfc_llcp_socket_release() use\nprocess-context lock_sock() instead of bh_lock_sock():\n\n1. Pop sockets from the local sockets list under the write lock using\n   nfc_llcp_sock_list_pop() so lock_sock() can be acquired without\n   holding the rwlock.\n\n2. Because lock_sock() can sleep, defer the final release of the\n   nfc_llcp_local structure to a workqueue (release_work).  This avoids\n   a sleeping-in-atomic bug when the last local reference is dropped\n   from softirq context.  Additionally, hold a single device reference\n   on local from registration until final destruction.\n\n3. In nfc_llcp_local_get(), use kref_get_unless_zero() to prevent\n   resurrecting a local object whose teardown has been scheduled.\n\n4. In llcp_sock_accept(), verify that the listener socket state is still\n   LLCP_LISTEN after waking from schedule_timeout() to prevent hangs if\n   the listener is closed concurrently.\n\n5. When unlinking unaccepted child sockets during listener release,\n   unlink them from local->sockets, call sock_orphan(), and drop their\n   initial sk_alloc creation reference via sock_put().\n\n6. Make nfc_llcp_accept_unlink() idempotent by guarding parent access with\n   a NULL check.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98580"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/41256821762a7114906b178826d17098e2fa5992"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/53867f6acb1af7f12d6485fa8a2819318f89083b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/54adcabb0f1deef1bdae5fc64779ed6d442721c9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7c938aad5108382c6ad7453c4b5ee8ae3f3252ed"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c3eef2f988a3db9690369d7cef9a3344dd9788d3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d2093a0981138876212bc5f473bdbfba0786e064"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d5e1c92d09caed19f2988739695ce611a86ba6f8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/da8a07757383614a8380a0f7dd54749d2687b82e"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:10Z"
  }
}