CVE-2026-23150: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23150 is a memory leak vulnerability in the Linux kernel's NFC LLCP (Logical Link Control Protocol) implementation, specifically within the nfc_llcp_send_ui_frame() function. It affects Linux kernel versions from 3.8 through multiple stable branches up to 6.19-rc7, including 5.10.x (before 5.10.249), 5.15.x (before 5.15.199), 6.1.x (before 6.1.162), 6.6.x (before 6.6.123), 6.12.x (before 6.12.69), and 6.13.x through 6.18.x (before 6.18.9). The vulnerability was published on February 14, 2026, with patches released on March 17, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel patches).

The root cause is a race condition (CWE-401: Missing Release of Memory after Effective Lifetime) between nfc_llcp_send_ui_frame() and local_cleanup() in the NFC LLCP subsystem. When nfc_llcp_local is being destroyed, local_cleanup() calls nfc_llcp_socket_release() (setting sock_error(sk) to -ENXIO) and then purges local->tx_queue; however, due to insufficient synchronization, nfc_llcp_send_ui_frame() running concurrently on another CPU can allocate a new socket buffer (skb) via nfc_alloc_send_skb() and enqueue it into local->tx_queue after the purge, leaving it permanently unreleased. The issue was originally surfaced by syzbot, which reported various memory leaks related to nfc_llcp_sock, sk_buff, and nfc_dev structures. Exploitation requires local access and low privileges to interact with the NFC socket interface (Feedly).

Successful exploitation allows a local attacker with low privileges to repeatedly trigger the race condition through the NFC socket interface, causing kernel memory to leak without being freed. Over time, this exhausts available system memory, leading to a denial of service (system instability or crash). There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

Apply the available kernel patches, which have been backported across all affected stable branches. Patched versions include: 5.10.249, 5.15.199, 6.1.162, 6.6.123, 6.12.69, 6.18.9, and 6.19-rc8 or later. Multiple kernel commits address this issue (kernel patch 1, kernel patch 2). As a workaround for systems that cannot be immediately patched, disable NFC functionality if it is not operationally required (e.g., via modprobe -r nfc or kernel boot parameters). Ubuntu has issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1) addressing this CVE (Ubuntu USN-8162-1, Ubuntu USN-8180-1).

The vulnerability has received routine coverage from Linux security aggregators and distribution security teams, including Ubuntu, SUSE, and Red Hat, all of which have issued advisories or patches. No notable independent researcher commentary or significant social media discussion has been identified beyond standard patch tracking (Ubuntu USN-8162-1).