CVE-2026-23330

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: complete pending data exchange on device close

In nciclosedevice(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsockdataexchange_complete) holds a socket reference.

NIPA occasionally hits this leak:

unreferenced object 0xff1100000f435000 (size 2048): comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc ec2b3c5): __kmallocnoprof+0x4db/0x730 skprotalloc.isra.0+0xe4/0x1d0 skalloc+0x36/0x760 rawsockcreate+0xd1/0x540 nfcsock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64syssocket+0x72/0xd0 dosyscall64+0x117/0xfc0 entrySYSCALL64afterhwframe+0x4b/0x53