Medium 5.5Published Mar 25, 2026

CVE-2026-23330nfc: nci: complete pending data exchange on device close

Updated under an hour ago (Oct 28, 2026, 12:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: complete pending data exchange on device close In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference. NIPA occasionally hits this leak: unreferenced object 0xff1100000f435000 (size 2048): comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc ec2b3c5): __kmalloc_noprof+0x4db/0x730 sk_prot_alloc.isra.0+0xe4/0x1d0 sk_alloc+0x36/0x760 rawsock_create+0xd1/0x540 nfc_sock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0x117/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	38f04c6b1b682f1879441e2925403ad9aff9e229 builds before 9df613ef6e8e873cdab969a11f74823488977f1f; from 38f04c6b1b682f1879441e2925403ad9aff9e229 before 702029337b057085ea13f964822dcd95e0fe53f5; from 38f04c6b1b682f1879441e2925403ad9aff9e229 before 91ff0d8c3464da7f0c43da38c195e60b660128bf; from 38f04c6b1b682f1879441e2925403ad9aff9e229 before d05f55d68ebdebb2b0a8480d766eaae88c8c92de; from 38f04c6b1b682f1879441e2925403ad9aff9e229 before 66083581945bd5b8e99fe49b5aeb83d03f62d053	CNA record
linux linux_kernel linux:linux_kernel	from 3.2.1 before 6.12.82; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 3.2; 7.0; 7.0; 7.0; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/9df613ef6e8e873cdab969a11f74823488977f1f
https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5	patch
https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf	patch
https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de	patch
https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.