CVE-2026-23150

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().

syzbot reported various memory leaks related to NFC, struct

nfc_llcp_sock, sk_buff, nfc_dev, etc. [0]

The leading log hinted that nfc_llcp_send_ui_frame() failed

to allocate skb due to sock_error(sk) being -ENXIO.

ENXIO is set by nfc_llcp_socket_release() when struct

nfc_llcp_local is destroyed by local_cleanup().

The problem is that there is no synchronisation between

nfc_llcp_send_ui_frame() and local_cleanup(), and skb

could be put into local->tx_queue after it was purged in

local_cleanup():

CPU1 CPU2

---- ----

nfc_llcp_send_ui_frame() local_cleanup()

|- do { '

|- pdu = nfc_alloc_send_skb(..., &err)

| .

| |- nfc_llcp_socket_release(local, false, ENXIO);

| |- skb_queue_purge(&local->

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References