CVE-2026-23339

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: free skb on nci_transceive early error paths

nci_transceive() takes ownership of the skb passed by the caller,

but the -EPROTO, -EINVAL, and -EBUSY error paths return without

freeing it.

Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes

the nci/nci_dev selftest hits the error path occasionally in NIPA,

and kmemleak detects leaks:

unreferenced object 0xff11000015ce6a40 (size 640):

comm "nci_dev", pid 3954, jiffies 4295441246

hex dump (first 32 bytes):

6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk

6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk

backtrace (crc 7c40cc2a):

kmem_cache_alloc_node_noprof+0x492/0x630

__alloc_skb+0x11e/0x5f0

alloc_skb_with_frags+0xc6/0x8f0

sock_alloc_send_pskb+0x326/0x3f0

nfc_alloc_send_skb+0x94/0x1d0

rawsock_sendmsg+0x162/0x4c0

do_syscall_64+0x117/0xfc0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References