CVE-2026-23330

nfc: nci: complete pending data exchange on device close

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: Oct 30, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: complete pending data exchange on device close

In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference.

NIPA occasionally hits this leak:

unreferenced object 0xff1100000f435000 (size 2048): comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc ec2b3c5): __kmalloc_noprof+0x4db/0x730 sk_prot_alloc.isra.0+0xe4/0x1d0 sk_alloc+0x36/0x760 rawsock_create+0xd1/0x540 nfc_sock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0x117/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	38f04c6b1b682f1879441e2925403ad9aff9e229 to before 75fdb22ef0635c02337de0c08c98f93f37b5cbeeAffected 38f04c6b1b682f1879441e2925403ad9aff9e229 to before 9df613ef6e8e873cdab969a11f74823488977f1fAffected 38f04c6b1b682f1879441e2925403ad9aff9e229 to before 702029337b057085ea13f964822dcd95e0fe53f5Affected 38f04c6b1b682f1879441e2925403ad9aff9e229 to before 91ff0d8c3464da7f0c43da38c195e60b660128bfAffected 38f04c6b1b682f1879441e2925403ad9aff9e229 to before d05f55d68ebdebb2b0a8480d766eaae88c8c92deAffected 38f04c6b1b682f1879441e2925403ad9aff9e229 to before 66083581945bd5b8e99fe49b5aeb83d03f62d053Affected
LinuxLinux	3.2Affected before 3.2Not affected 6.1.191 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.82 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

38f04c6b1b682f1879441e2925403ad9aff9e229 to before 75fdb22ef0635c02337de0c08c98f93f37b5cbeeAffected
38f04c6b1b682f1879441e2925403ad9aff9e229 to before 9df613ef6e8e873cdab969a11f74823488977f1fAffected
38f04c6b1b682f1879441e2925403ad9aff9e229 to before 702029337b057085ea13f964822dcd95e0fe53f5Affected
38f04c6b1b682f1879441e2925403ad9aff9e229 to before 91ff0d8c3464da7f0c43da38c195e60b660128bfAffected
38f04c6b1b682f1879441e2925403ad9aff9e229 to before d05f55d68ebdebb2b0a8480d766eaae88c8c92deAffected
38f04c6b1b682f1879441e2925403ad9aff9e229 to before 66083581945bd5b8e99fe49b5aeb83d03f62d053Affected

LinuxLinux

3.2Affected
before 3.2Not affected
6.1.191 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.82 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.