CVE-2026-23339

nfc: nci: free skb on nci_transceive early error paths

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: Oct 15, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: free skb on nci_transceive early error paths

nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it.

Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes the nci/nci_dev selftest hits the error path occasionally in NIPA, and kmemleak detects leaks:

unreferenced object 0xff11000015ce6a40 (size 640): comm "nci_dev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmem_cache_alloc_node_noprof+0x492/0x630 __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xc6/0x8f0 sock_alloc_send_pskb+0x326/0x3f0 nfc_alloc_send_skb+0x94/0x1d0 rawsock_sendmsg+0x162/0x4c0 do_syscall_64+0x117/0xfc0

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6a2968aaf50c7a22fced77a5e24aa636281efca8 to before b367cb44d919f35b07cd56feffa15e68cd9f53f9Affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 6d898f943766440cf766d30364e715111c3563b5Affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 33f6b8a96dda045789796c3bcb451c74ac158039Affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before dcbcccfc5195c9caaa4bb8d31f23c345f00a9e89Affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 3245801d44a44c090acefe19a12d22d12cac45c5Affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 9d448bbab724b94d6c561e1f314656f5b88a7cb3Affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 54f7f0eaafa56b5994cdb5c7967946922c2e1d22Affected 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 7bd4b0c4779f978a6528c9b7937d2ca18e936e2cAffected
LinuxLinux	3.2Affected before 3.2Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

6a2968aaf50c7a22fced77a5e24aa636281efca8 to before b367cb44d919f35b07cd56feffa15e68cd9f53f9Affected
6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 6d898f943766440cf766d30364e715111c3563b5Affected
6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 33f6b8a96dda045789796c3bcb451c74ac158039Affected
6a2968aaf50c7a22fced77a5e24aa636281efca8 to before dcbcccfc5195c9caaa4bb8d31f23c345f00a9e89Affected
6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 3245801d44a44c090acefe19a12d22d12cac45c5Affected
6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 9d448bbab724b94d6c561e1f314656f5b88a7cb3Affected
6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 54f7f0eaafa56b5994cdb5c7967946922c2e1d22Affected
6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 7bd4b0c4779f978a6528c9b7937d2ca18e936e2cAffected

LinuxLinux

3.2Affected
before 3.2Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.