CVE-2026-23167

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix race between rfkill and nci_unregister_device().

syzbot reported the splat below [0] without a repro.

It indicates that struct nci_dev.cmd_wq had been destroyed before

nci_close_device() was called via rfkill.

nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which

(I think) was called from virtual_ncidev_close() when syzbot close()d

an fd of virtual_ncidev.

The problem is that nci_unregister_device() destroys nci_dev.cmd_wq

first and then calls nfc_unregister_device(), which removes the

device from rfkill by rfkill_unregister().

So, the device is still visible via rfkill even after nci_dev.cmd_wq

is destroyed.

Let's unregister the device from rfkill first in nci_unregister_device().

Note that we cannot call nfc_unregister_device() before

nci_close_device() because

1) nfc_unregister_device() calls device_del() which frees

all memory allocated by devm_kzalloc() and linked to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References