CVE-2023-53298: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53298 is a memory leak vulnerability discovered in the Linux kernel's NFC subsystem, specifically in the nfcgenlse_io function. The vulnerability was reported and documented on September 16, 2025. The issue affects the secure element communication functionality in the Linux kernel's NFC implementation (NVD).

The vulnerability occurs when the callback context for sending/receiving APDUs (Application Protocol Data Units) to/from the selected secure element is allocated inside nfcgenlseio. While this context is supposed to be freed in the seiocb callback function, there are several error paths where the bwitimer is not charged to call seiocb later, resulting in a memory leak of the cbcontext. The issue is complicated by the fact that checking 'dev->ops->seio()' return value is insufficient as it may be negative in both cases: when the timer was charged and when it was not (NVD).

The primary impact of this vulnerability is a memory leak in the Linux kernel's NFC subsystem. Over time, this could lead to resource exhaustion and potential system instability if the affected code path is repeatedly triggered (NVD).

The vulnerability has been addressed through a patch that proposes to free the cb_context explicitly on the identified error paths. This ensures proper resource cleanup regardless of the timer state (NVD).