CVE-2023-1990

What it actually does

Use-after-free condition in ndlc_remove within the st-nci NFC driver allows a local race to dereference freed memory, resulting in a kernel crash and denial of service.

Why it matters to the business

Systems using the affected Linux kernel version with ST-NCI NFC hardware may experience unexpected crashes and service interruptions; the low exploitability and lack of known campaigns limit widespread operational risk but still require patching for stability on NFC-enabled devices.

How an attack unfolds

An attacker with local user access crafts input or timing that triggers concurrent calls to ndlc_remove, exploiting the race to free a structure that is still referenced, causing the kernel to panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 457391b0380335d5e9a5babdec90ac53928b23b4 or later; rebuild and deploy the updated kernel package across affected systems, then reboot.

How to confirm the fix worked

Confirm the running kernel source contains commit 457391b0380335d5e9a5babdec90ac53928b23b4 via git log or package version checks; attempt to exercise the ndlc_remove path under load to verify absence of crashes.

Typical attack path

1. Obtain local shell or user privileges on the target system
2. Locate or load the st-nci NFC driver and prepare concurrent operations on the ndlc interface
3. Trigger the race condition through repeated or parallel device removal sequences
4. Observe kernel panic and system reboot or halt

How to detect it

Inspect kernel logs for oops or panic messages referencing ndlc_remove or st-nci; correlate with audit logs showing local user activity on NFC device nodes around the time of the crash.

What your security team should do

• Prioritize kernel updates on any hosts exposing NFC hardware or running the st-nci driver
• Review systems for the presence of the vulnerable driver and schedule reboots after patching
• Monitor kernel update channels for backports to supported distribution kernels