CVE-2026-23330: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23330 is a resource leak vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem, specifically in the nci_close_device() function of the NCI (NFC Controller Interface) driver. When an NFC device is closed, the function fails to complete pending data exchange operations, causing socket references held by callbacks such as rawsock_data_exchange_complete to never be released. This affects Linux kernel versions from 3.2.1 through 6.12.82, 6.13 through 6.18.17, 6.19 through 6.19.7, and all 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local access and low privileges to exploit (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). In nci_close_device(), the kernel does not invoke completion on any in-flight data exchange before tearing down the device; the data exchange callback (e.g., rawsock_data_exchange_complete) retains a socket reference that is never decremented, leaving a 2048-byte kernel object unreferenced. The NIPA (kernel testing infrastructure) detected this leak via kmemleak, with the backtrace tracing through sk_alloc → rawsock_create → nfc_sock_create. The attack vector is local, requiring low privileges and no user interaction. Upstream patches are available via kernel.org stable repositories (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

A local attacker with low privileges can repeatedly open NFC raw sockets and trigger device close operations without completing pending data exchanges, causing 2048 bytes of kernel memory to leak per occurrence. Over time, cumulative memory exhaustion can render the system unresponsive, resulting in a denial of service. The vulnerability has no impact on confidentiality or integrity — privilege escalation and data theft are not possible through this flaw (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. No threat actor attribution has been observed (Red Hat Advisory, Feedly).

• Logs: Kernel kmemleak reports referencing nci_dev process with unreferenced objects of size 2048 bytes; backtrace entries including rawsock_create, nfc_sock_create, sk_alloc in kernel logs (dmesg or /var/log/kern.log).
• Process: Repeated creation of NFC raw sockets by a low-privilege process (comm: nci_dev) visible in process accounting or audit logs.
• System Behavior: Gradual increase in unreclaimable kernel memory (/proc/meminfo showing rising Slab or KernelStack values); system unresponsiveness under sustained NFC socket operations.

Apply the upstream kernel patches available via kernel.org stable repositories targeting the following fixed versions: 6.12.82 or later, 6.18.17 or later, 6.19.7 or later, and 7.0-rc3 or later. Systems without NFC hardware or with the NFC subsystem disabled (e.g., modprobe -r nfc) have significantly reduced exposure. Prioritize patching on systems with NFC devices enabled or where untrusted local users have access (Red Hat Advisory, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).

Red Hat tracked the issue via Bugzilla (ID: 2451276) and published a security advisory, rating it medium severity. The upstream kernel community disclosed the fix through the linux-cve-announce mailing list. No significant social media discussion or notable researcher commentary beyond standard vulnerability tracking has been observed (Red Hat Bugzilla).