CVE-2024-26825

What it actually does

Memory leak of rx_data_reassembly skb on NCI device deallocation before fragment processing or RF deactivate NTF, due to missing cleanup in nfc nci code.

Why it matters to the business

Gradual memory exhaustion on Linux systems handling NFC data exchange can degrade performance, trigger OOM kills, or cause system instability in affected kernels; high ecosystem prevalence increases patch urgency.

How an attack unfolds

An attacker crafts sequences of fragmented NCI data packets followed by rapid NCI device cleanup to leave rx_data_reassembly skb allocated without being freed, accumulating leaks; no named threat actors or ransomware use reported.

How to fix it

Update Linux kernel to commit 7e9a8498658b398bf11b8e388005fa54e40aed81 or later stable versions containing the nci cleanup fix; apply vendor backports where available.

How to confirm the fix worked

Confirm kernel source includes the rx_data_reassembly free on device cleanup path; run syzkaller or targeted NCI fuzz tests to verify no leaks on deallocation; check /proc/slabinfo or kmemleak for skb remnants post-cleanup.

Typical attack path

1. Trigger NCI device initialization and data exchange with fragmented packets
2. Force device deallocation before last fragment or deactivate NTF
3. Repeat to accumulate leaked skb buffers
4. Monitor for memory pressure or OOM events

How to detect it

Review kernel logs for repeated NCI device alloc/free patterns without corresponding skb frees; inspect memory usage spikes correlated with NFC traffic; audit dmesg or ftrace for nci_rx_work or device cleanup events.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NFC interfaces
• Monitor EPSS and KEV status for any future elevation
• Enable kernel memory debugging (kmemleak) in test environments
• Restrict NFC functionality to least privilege where possible