In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on ncitransceive early error paths ncitransceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCIDATAEXCHANGE fixed by subsequent changes the nci/ncidev selftest hits the error path occasionally in NIPA, and kmemleak detects leaks: unreferenced object 0xff11000015ce6a40 (size 640): comm "ncidev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmemcacheallocnodenoprof+0x492/0x630 _allocskb+0x11e/0x5f0 allocskbwithfrags+0xc6/0x8f0 sockallocsendpskb+0x326/0x3f0 nfcallocsendskb+0x94/0x1d0 rawsocksendmsg+0x162/0x4c0 dosyscall64+0x117/0xfc0