CVE-2026-23339: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23339 is a memory leak vulnerability in the Linux kernel's NFC NCI (Near Field Communication Controller Interface) subsystem. The nci_transceive() function takes ownership of a socket buffer (skb) passed by the caller but fails to free it on three error return paths (-EPROTO, -EINVAL, and -EBUSY), causing unreferenced memory objects to accumulate over time. The vulnerability was disclosed on March 25, 2026, and affects Linux kernel versions from 3.2 through multiple stable branches up to 7.0-rc7. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local access with low privileges (Red Hat CVE, Feedly).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). In nci_transceive(), when the function encounters error conditions (-EPROTO, -EINVAL, or -EBUSY), it returns early without calling kfree_skb() on the socket buffer whose ownership it has assumed from the caller. This is compounded by a related issue with clearing the NCI_DATA_EXCHANGE flag, which causes the NCI selftest to hit these error paths more frequently. The kernel memory leak detector (kmemleak) identifies the leaked objects originating from the rawsock_sendmsg → nfc_alloc_send_skb → nci_transceive call chain (Red Hat CVE).

Repeated triggering of the vulnerable error paths causes cumulative kernel memory exhaustion, leading to denial of service conditions and potential system instability. An attacker with local access and low privileges can repeatedly invoke NFC transceive operations that hit these error conditions, gradually consuming non-reclaimable kernel memory. There is no confidentiality or integrity impact; the vulnerability is limited to availability (kernel memory exhaustion). The vulnerability affects a wide range of kernel versions spanning from 3.2.1 through 5.10.252, 5.11–5.15.202, 5.16–6.1.166, 6.2–6.6.129, 6.7–6.12.76, 6.13–6.18.16, 6.19–6.19.6, and 7.0-rc1 through 7.0-rc7 (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting very low probability of exploitation in the near term. Exploitation requires local access with low privileges and the presence of NFC hardware or a virtual NFC device, further limiting the practical attack surface (Red Hat CVE).

• Logs: Kernel log (dmesg) entries from kmemleak reporting unreferenced objects with backtraces involving rawsock_sendmsg, nfc_alloc_send_skb, nci_transceive, and __alloc_skb.
• System Behavior: Gradual increase in kernel memory consumption (/proc/meminfo showing declining MemFree/MemAvailable) without a corresponding increase in user-space process memory usage, particularly on systems with NFC activity.
• Process: Repeated NFC-related system calls (sendmsg) from a low-privilege process targeting NFC raw sockets, potentially visible in strace output or audit logs.
• File System: Presence of kmemleak output files (e.g., /sys/kernel/debug/kmemleak) containing entries referencing nci_dev or rawsock_sendmsg in the backtrace.

Patches have been released across all affected stable kernel branches: update to Linux kernel 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 (or later) as appropriate for your deployment. For systems that cannot be immediately patched, consider disabling NFC functionality if not operationally required, restricting local user access to NFC subsystem resources via access controls (e.g., udev rules, seccomp, or capability restrictions), or blacklisting the nfc and nci kernel modules. Monitoring for abnormal NFC error rates and memory pressure can help detect exploitation attempts (Red Hat CVE, Kernel Patch).