Cloudanix VulnDB

CVE-2026-23339

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can slowly leak memory when certain NFC operations fail, which may eventually make the system unstable if the problem happens many times.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to release socket buffer ownership on error return paths in nci_transceive leads to permanent kernel memory leaks.

Why it matters to the business

Repeated local NFC operations can gradually exhaust kernel memory, degrading system stability and potentially causing denial of service on affected Linux systems.

How an attack unfolds

An attacker with local access triggers the error paths in nci_transceive by sending crafted NFC messages that hit EPROTO, EINVAL, or EBUSY conditions, causing the kernel to leak skb allocations without freeing them.

How to fix it

Apply the upstream fix that ensures skb release on all error paths in nci_transceive; monitor kernel changelogs for the commit titled 'nfc: nci: free skb on nci_transceive early error paths' and backport to supported distributions.

How to confirm the fix worked

Inspect the nci_transceive function for unconditional kfree_skb calls on the identified error paths; run the nci/nci_dev selftest under NIPA and confirm kmemleak reports no new leaks from this path.

Typical attack path

  1. Obtain local user access on a Linux system with NFC support enabled.
  2. Interact with the NFC raw socket interface to invoke nci_transceive.
  3. Craft input that consistently hits one of the three early error paths.
  4. Repeat the operation to accumulate leaked kernel memory until resource pressure occurs.

How to detect it

Monitor kmemleak output for unreferenced skb allocations with backtraces containing nfc_alloc_send_skb and rawsock_sendmsg; watch for steadily rising kernel slab memory usage correlated with NFC activity.

  • unreferenced object.*size 640.*comm "nci_dev"
  • backtrace.*nfc_alloc_send_skb.*rawsock_sendmsg

What your security team should do

  • Prioritize kernel updates containing the referenced fix within standard patch windows.
  • Disable NFC kernel modules on systems where NFC is not required.
  • Enable kmemleak or similar kernel memory debugging on test and canary systems to detect similar leaks early.

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on nci_transceive early error paths nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes the nci/nci_dev selftest hits the error path occasionally in NIPA, and kmemleak detects leaks: unreferenced object 0xff11000015ce6a40 (size 640): comm "nci_dev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmem_cache_alloc_node_noprof+0x492/0x630 __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xc6/0x8f0 sock_alloc_send_pskb+0x326/0x3f0 nfc_alloc_send_skb+0x94/0x1d0 rawsock_sendmsg+0x162/0x4c0 do_syscall_64+0x117/0xfc0

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities