{"id":"CVE-2026-23330","state":"PUBLISHED","title":"nfc: nci: complete pending data exchange on device close","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: complete pending data exchange on device close\n\nIn nci_close_device(), complete any pending data exchange before\nclosing. The data exchange callback (e.g.\nrawsock_data_exchange_complete) holds a socket reference.\n\nNIPA occasionally hits this leak:\n\nunreferenced object 0xff1100000f435000 (size 2048):\n  comm \"nci_dev\", pid 3954, jiffies 4295441245\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  '..@............\n  backtrace (crc ec2b3c5):\n    __kmalloc_noprof+0x4db/0x730\n    sk_prot_alloc.isra.0+0xe4/0x1d0\n    sk_alloc+0x36/0x760\n    rawsock_create+0xd1/0x540\n    nfc_sock_create+0x11f/0x280\n    __sock_create+0x22d/0x630\n    __sys_socket+0x115/0x1d0\n    __x64_sys_socket+0x72/0xd0\n    do_syscall_64+0x117/0xfc0\n    entry_SYSCALL_64_after_hwframe+0x4b/0x53","publishedAt":"2026-03-25T10:27:21.871Z","updatedAt":"2026-10-30T12:23:57.014Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"75fdb22ef0635c02337de0c08c98f93f37b5cbee","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"9df613ef6e8e873cdab969a11f74823488977f1f","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"702029337b057085ea13f964822dcd95e0fe53f5","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"91ff0d8c3464da7f0c43da38c195e60b660128bf","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"d05f55d68ebdebb2b0a8480d766eaae88c8c92de","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"66083581945bd5b8e99fe49b5aeb83d03f62d053","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/nci/core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.2","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.136","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.82","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.17","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.7","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/nci/core.c"]}],"references":["https://git.kernel.org/stable/c/75fdb22ef0635c02337de0c08c98f93f37b5cbee","https://git.kernel.org/stable/c/9df613ef6e8e873cdab969a11f74823488977f1f","https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5","https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf","https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de","https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053"],"weaknesses":[],"ingestedAt":"2026-10-30T12:40:04.423Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23330.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23330","state":"PUBLISHED","datePublished":"2026-03-25T10:27:21.871Z","dateUpdated":"2026-10-30T12:23:57.014Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-13T15:37:45.996Z"},"containers":{"cna":{"title":"nfc: nci: complete pending data exchange on device close","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: complete pending data exchange on device close\n\nIn nci_close_device(), complete any pending data exchange before\nclosing. The data exchange callback (e.g.\nrawsock_data_exchange_complete) holds a socket reference.\n\nNIPA occasionally hits this leak:\n\nunreferenced object 0xff1100000f435000 (size 2048):\n  comm \"nci_dev\", pid 3954, jiffies 4295441245\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  '..@............\n  backtrace (crc ec2b3c5):\n    __kmalloc_noprof+0x4db/0x730\n    sk_prot_alloc.isra.0+0xe4/0x1d0\n    sk_alloc+0x36/0x760\n    rawsock_create+0xd1/0x540\n    nfc_sock_create+0x11f/0x280\n    __sock_create+0x22d/0x630\n    __sys_socket+0x115/0x1d0\n    __x64_sys_socket+0x72/0xd0\n    do_syscall_64+0x117/0xfc0\n    entry_SYSCALL_64_after_hwframe+0x4b/0x53"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"75fdb22ef0635c02337de0c08c98f93f37b5cbee","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"9df613ef6e8e873cdab969a11f74823488977f1f","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"702029337b057085ea13f964822dcd95e0fe53f5","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"91ff0d8c3464da7f0c43da38c195e60b660128bf","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"d05f55d68ebdebb2b0a8480d766eaae88c8c92de","versionType":"git"},{"version":"38f04c6b1b682f1879441e2925403ad9aff9e229","status":"affected","lessThan":"66083581945bd5b8e99fe49b5aeb83d03f62d053","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/nci/core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.2","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.136","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.82","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.17","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.7","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/nci/core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/75fdb22ef0635c02337de0c08c98f93f37b5cbee"},{"url":"https://git.kernel.org/stable/c/9df613ef6e8e873cdab969a11f74823488977f1f"},{"url":"https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5"},{"url":"https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf"},{"url":"https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de"},{"url":"https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:23:57.014Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.6.136"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.12.82"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.18.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.19.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}