Cloudanix VulnDB

CVE-2026-23330

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can slowly leak memory when near-field communication hardware is used, eventually making the computer slower or unstable.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in Linux kernel NFC NCI code where nci_close_device() fails to complete pending data exchanges, leaving socket references (allocated via sk_alloc/rawsock_create) unreleased and resulting in unreferenced kmalloc objects.

Why it matters to the business

Gradual memory exhaustion on NFC-enabled Linux systems can degrade performance, trigger OOM conditions, or cause instability during prolonged device usage.

How an attack unfolds

A local attacker interacts with the NFC subsystem to create sockets and initiate data exchanges, then forces device closure before completion so the kernel retains the allocated socket structures indefinitely.

How to fix it

Apply the upstream fix that calls the data-exchange completion handler inside nci_close_device() before releasing the device; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the nci_close_device() path now invokes the pending-exchange completion callback; run NFC socket creation/close cycles under kmemleak or slabinfo monitoring to verify no new unreferenced objects appear.

Typical attack path

  1. Obtain local user access on an NFC-capable Linux host
  2. Create NFC sockets and start data exchange operations
  3. Trigger nci_close_device while exchanges remain pending
  4. Repeat to accumulate leaked kernel memory objects

How to detect it

Inspect kernel logs and kmemleak reports for unreferenced objects allocated by sk_prot_alloc or rawsock_create during nci_dev activity; correlate with NFC socket creation syscalls.

What your security team should do

  • Patch Linux kernels on all NFC-equipped hosts as soon as the fix is available
  • Restrict unprivileged local access to NFC devices via udev or capability controls
  • Add memory-usage alerts for systems exposing NFC interfaces

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: complete pending data exchange on device close In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference. NIPA occasionally hits this leak: unreferenced object 0xff1100000f435000 (size 2048): comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc ec2b3c5): __kmalloc_noprof+0x4db/0x730 sk_prot_alloc.isra.0+0xe4/0x1d0 sk_alloc+0x36/0x760 rawsock_create+0xd1/0x540 nfc_sock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0x117/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities