CVE-2026-23291: nfc: pn533: properly drop the usb interface reference on disconnect
In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: properly drop the usb interface reference on disconnect
When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbed in the probe callback. Fix this up by properly dropping the reference after we are done with it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23291?
CVE-2026-23291 has been classified with a medium severity due to the potential for a dangling reference count that could lead to memory management issues.
How do I fix CVE-2026-23291?
To fix CVE-2026-23291, ensure you update to the latest version of the Linux kernel where this vulnerability has been properly addressed.
Which systems are affected by CVE-2026-23291?
CVE-2026-23291 affects the Linux kernel and its associated implementations, particularly those using the pn533 NFC driver.
What impact does CVE-2026-23291 have on system security?
The impact of CVE-2026-23291 can potentially include system instability and vulnerabilities to denial of service attacks due to improper handling of device disconnections.
Is there a known exploit for CVE-2026-23291?
As of now, there are no public exploits specifically targeting CVE-2026-23291, but it is advisable to apply the fix to mitigate any potential risks.