CVE-2026-23339: nfc: nci: free skb on nci_transceive early error paths
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: free skb on ncitransceive early error paths
ncitransceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it.
Due to issues clearing NCIDATAEXCHANGE fixed by subsequent changes the nci/ncidev selftest hits the error path occasionally in NIPA, and kmemleak detects leaks:
unreferenced object 0xff11000015ce6a40 (size 640): comm "ncidev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmemcacheallocnodenoprof+0x492/0x630 allocskb+0x11e/0x5f0 allocskbwithfrags+0xc6/0x8f0 sockallocsendpskb+0x326/0x3f0 nfcallocsendskb+0x94/0x1d0 rawsocksendmsg+0x162/0x4c0 dosyscall64+0x117/0xfc0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel NFC NCI subsystem are exposed when nci_transceive() is invoked and reaches the -EPROTO, -EINVAL, or -EBUSY early error paths. The reported allocation path originates from NFC raw-socket send operations.
What does an attacker need to exploit it?
The CVSS vector indicates local access and low privileges are required, with no user interaction. Exploitation depends on being able to trigger the affected NFC NCI transaction error paths.
What is the impact?
The affected error paths leak an skb because nci_transceive() has taken ownership of it but does not free it before returning. The stated security impact is high availability impact, with no confidentiality or integrity impact.
How can I tell whether the issue is occurring?
kmemleak can report unreferenced skb-related allocations associated with the nci_dev process or test activity. The report cites a 640-byte leaked object and an allocation stack including nfc_alloc_send_skb and rawsock_sendmsg.
What should be done if patching is not immediately possible?
No workaround is provided in the available data. Apply an available patch when possible and avoid triggering the affected NFC NCI error paths where operationally feasible.