CVE-2023-53298: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53298 is a memory leak vulnerability in the Linux kernel's Near Field Communication (NFC) subsystem, specifically within the nfc_genl_se_io function. The flaw occurs when the callback context (cb_context) allocated for sending/receiving APDUs to/from a selected secure element is not freed on certain error paths where the bwi_timer is not charged. It affects Linux kernel versions from 3.13 through 6.2.x, with fixed versions including 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.100, 6.1.18, and 6.2.5. The vulnerability was published on September 16, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). Inside nfc_genl_se_io, a cb_context structure is allocated to serve as the callback context for APDU operations with a secure element; it is intended to be freed by the se_io_cb callback once the bwi_timer fires. However, on error paths where dev->ops->se_io() returns a negative value without having charged the timer, se_io_cb is never invoked and the cb_context is leaked. The fix explicitly frees cb_context on those error paths, since the return value of se_io() alone cannot reliably distinguish whether the timer was charged (Red Hat CVE, Feedly). Exploitation requires local access with low privileges (e.g., a user able to invoke NFC generic netlink operations).

Successful exploitation allows a local attacker with low privileges to gradually exhaust kernel memory by repeatedly triggering the memory leak in the NFC subsystem, leading to denial of service through system performance degradation or instability. There is no confidentiality or integrity impact; the sole consequence is high availability impact as kernel memory is consumed without release (Feedly, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained to local attackers with at least low-level privileges on systems with NFC functionality enabled (Feedly).

Apply the kernel patch corresponding to your installed version: update to 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.100, 6.1.18, or 6.2.5 (or later) as appropriate. For systems that cannot be patched immediately, consider disabling NFC kernel modules (modprobe -r nfc) if NFC functionality is not required, implementing kernel memory monitoring to detect anomalous growth, and restricting local user access to NFC-related interfaces. Upstream patches are available via the stable kernel tree (Red Hat CVE, Feedly).