CVE-2026-23330

kernel: nfc: nci: complete pending data exchange on device close

Loading…

Severity

Moderate

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · March 25, 2026

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel's Near Field Communication (NFC) Controller Interface (NCI) subsystem. When an NFC device is closed, the nci_close_device() function may not properly complete pending data exchanges. This can lead to a resource leak, where unreferenced socket objects consume system memory. Over time, this resource exhaustion could result in a Denial of Service (DoS) for the system.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-772 · Missing Release of Resource after Effective Lifetime