CVE-2026-23291

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23291
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbed in the probe callback. Fix this up by properly dropping the reference after we are done with it.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb Patch
https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e Patch
https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74 Patch
https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6 Patch
https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770 Patch
https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7 Patch
https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886 Patch
https://git.kernel.org/stable/c/d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
History

29 May 2026, 15:07

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb - () https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb - Patch
References () https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e - () https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e - Patch
References () https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74 - () https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74 - Patch
References () https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6 - () https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6 - Patch
References () https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770 - () https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770 - Patch
References () https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7 - () https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7 - Patch
References () https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886 - () https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886 - Patch
References () https://git.kernel.org/stable/c/d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0 - () https://git.kernel.org/stable/c/d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE NVD-CWE-Other

18 Apr 2026, 09:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6 -
  • () https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770 -
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: nfc: pn533: soltar correctamente la referencia de la interfaz USB al desconectarse Cuando el dispositivo se desconecta del controlador, hay un contador de referencias 'colgante' en la interfaz USB que fue obtenida en la función de devolución de llamada de sondeo. Solucionar esto soltando correctamente la referencia después de que hayamos terminado con ella.

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-05-29 15:07

NVD link : CVE-2026-23291

Mitre link : CVE-2026-23291

CVE.ORG link : CVE-2026-23291

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-Other