CVE-2026-23330

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23330
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: complete pending data exchange on device close In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference. NIPA occasionally hits this leak: unreferenced object 0xff1100000f435000 (size 2048): comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc ec2b3c5): __kmalloc_noprof+0x4db/0x730 sk_prot_alloc.isra.0+0xe4/0x1d0 sk_alloc+0x36/0x760 rawsock_create+0xd1/0x540 nfc_sock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0x117/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053 Patch
https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5 Patch
https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf Patch
https://git.kernel.org/stable/c/9df613ef6e8e873cdab969a11f74823488977f1f
https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
History

27 Apr 2026, 14:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/9df613ef6e8e873cdab969a11f74823488977f1f -

23 Apr 2026, 21:10

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053 - () https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053 - Patch
References () https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5 - () https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5 - Patch
References () https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf - () https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf - Patch
References () https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de - () https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de - Patch
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

18 Apr 2026, 09:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5 -
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: nfc: nci: completar el intercambio de datos pendiente al cerrar el dispositivo En nci_close_device(), completar cualquier intercambio de datos pendiente antes de cerrar. La devolución de llamada de intercambio de datos (por ejemplo, rawsock_data_exchange_complete) mantiene una referencia de socket. NIPA ocasionalmente encuentra esta fuga: objeto sin referencia 0xff1100000f435000 (tamaño 2048): comm 'nci_dev', pid 3954, jiffies 4295441245 volcado hexadecimal (primeros 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ rastreo de pila (crc ec2b3c5): __kmalloc_noprof+0x4db/0x730 sk_prot_alloc.isra.0+0xe4/0x1d0 sk_alloc+0x36/0x760 rawsock_create+0xd1/0x540 nfc_sock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0x117/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-04-27 14:16

NVD link : CVE-2026-23330

Mitre link : CVE-2026-23330

CVE.ORG link : CVE-2026-23330

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime