CVE-2026-23339

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: free skb on nci_transceive early error paths

nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it.

Due to issues clearing NCIDATAEXCHANGE fixed by subsequent changes the nci/nci_dev selftest hits the error path occasionally in NIPA, and kmemleak detects leaks:

unreferenced object 0xff11000015ce6a40 (size 640): comm "ncidev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmemcacheallocnode_noprof+0x492/0x630 _allocskb+0x11e/0x5f0 allocskbwithfrags+0xc6/0x8f0 sockallocsendpskb+0x326/0x3f0 nfcallocsendskb+0x94/0x1d0 rawsocksendmsg+0x162/0x4c0 dosyscall64+0x117/0xfc0