CVE-2026-23167: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23167 is a race condition vulnerability in the Linux kernel's NFC (Near Field Communication) NCI subsystem, specifically between the rfkill interface and the nci_unregister_device() function. The flaw occurs because nci_unregister_device() destroys the nci_dev.cmd_wq workqueue before unregistering the device from rfkill, leaving the device visible via rfkill after critical internal structures have been freed. Affected kernel versions include 3.2 through 5.10.248, 5.11 through 5.15.198, 5.16 through 6.1.161, 6.2 through 6.6.122, 6.7 through 6.12.68, and 6.13 through 6.18.8. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly).

The root cause is a concurrent execution race condition (CWE-362) in the Linux kernel NFC NCI subsystem. When nci_unregister_device() is called (e.g., from virtual_ncidev_close()), it destroys nci_dev.cmd_wq first and then calls nfc_unregister_device(), which removes the device from rfkill via rfkill_unregister(). This ordering creates a time window where rfkill can still trigger nci_close_device() on an already-destroyed workqueue, resulting in a use-after-free condition. The fix restructures the unregistration sequence to remove the rfkill interface first — by splitting nfc_unregister_device() into two functions — before destroying internal NCI structures, preventing the race (Feedly, Kernel Patch). The vulnerability was originally identified by syzbot, a kernel fuzzing tool, which reported the splat without a reproducer.

Successful exploitation can result in kernel crashes (denial of service) due to the use-after-free condition triggered when rfkill accesses freed nci_dev.cmd_wq memory. In more severe scenarios, the memory corruption could potentially be leveraged for arbitrary kernel code execution, though this is considered difficult in practice. The impact is limited to availability (kernel crash/panic) in the most likely exploitation scenario, with no confidentiality or integrity impact assessed (Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed (Feedly). The vulnerability requires local access with low user privileges and high attack complexity, as the attacker must win a timing race between rfkill operations and device unregistration. The EPSS score is 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Upgrade to a patched Linux kernel version: 5.10.249 or later, 5.15.199 or later, 6.1.162 or later, 6.6.123 or later, 6.12.69 or later, or 6.18.9 or later. Fixes have been backported to all affected stable branches via multiple kernel commits (Kernel Patch). Ubuntu has issued security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1, USN-8393-1) addressing this vulnerability (Ubuntu USN-8180-1). As a temporary workaround where patching is not immediately possible, restrict access to rfkill interfaces to trusted users only, since exploitation requires low-privilege local access (Feedly).