CVE-2026-23167: Linux Kernel Race Condition Vulnerability

CVE-2026-23167 Overview

CVE-2026-23167 is a race condition vulnerability in the Linux kernel's Near Field Communication (NFC) Controller Interface (NCI) subsystem. The flaw exists between the rfkill subsystem and nci_unregister_device(). An attacker with local access can trigger the race by closing a virtual NCI device file descriptor while rfkill operations are in flight. The nci_dev.cmd_wq workqueue is destroyed before the device is removed from rfkill, allowing nci_close_device() to operate on freed resources. The issue was reproduced by syzbot on a kernel running PREEMPT(full).

Critical Impact
Successful exploitation results in kernel lockdep warnings and potential denial of service through use of a destroyed workqueue, affecting host availability.

Affected Products

Linux Kernel 6.19-rc1 through 6.19-rc7
Linux Kernel stable branches prior to the patched commits
Distributions shipping kernels with the NFC NCI subsystem enabled

Discovery Timeline

2026-02-14 - CVE CVE-2026-23167 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23167

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the NFC NCI core located at net/nfc/nci/core.c. The nci_unregister_device() function destroys the nci_dev.cmd_wq workqueue before calling nfc_unregister_device(), which is responsible for removing the device from the rfkill registry through rfkill_unregister(). This ordering leaves the device visible to userspace rfkill interfaces after its command workqueue no longer exists.

A local user can write to /dev/rfkill to block the NFC device. The kernel then calls nfc_rfkill_set_block(), which descends into nci_close_device() and attempts to flush the already-destroyed cmd_wq. This triggers a DEBUG_LOCKS_WARN_ON(1) in __lock_acquire() and corrupts workqueue lockdep state.

Root Cause

The root cause is incorrect teardown ordering inside nci_unregister_device(). The function destroys synchronization primitives before unregistering the device from external subsystems that hold references to it. Userspace can still reach the device through rfkill_fop_write() and invoke nci_close_device() on torn-down state.

Attack Vector

Exploitation requires local access and the ability to open a virtual NCI device file descriptor and write to the rfkill character device. The attacker races the close of the NCI fd against an rfkill block operation targeting the same device. The patch reorders teardown so rfkill unregistration occurs first, and splits nfc_unregister_device() into two phases to preserve conn_info_list integrity during nci_rx_work().

No verified public proof-of-concept code is available. The flaw was originally reported by the syzbot fuzzing infrastructure without a reproducer.

Detection Methods for CVE-2026-23167

Indicators of Compromise

Kernel warnings referencing DEBUG_LOCKS_WARN_ON(1) at kernel/locking/lockdep.c:238 in __lock_acquire
Call traces containing nci_close_device, nfc_rfkill_set_block, and rfkill_fop_write
Unexpected processes accessing /dev/rfkill and virtual NCI device nodes in close succession

Detection Strategies

Collect dmesg output and centralize kernel ring buffer logs to surface lockdep splats tied to the NFC NCI subsystem.
Audit syscall sequences that combine close() on virtual NCI file descriptors with write() to /dev/rfkill from the same or related processes.
Apply behavioral analytics to flag unprivileged processes triggering repeated rfkill state changes on NFC adapters.

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on stack frames containing nci_unregister_device or nci_close_device.
Monitor access patterns to /dev/rfkill and NFC device nodes, particularly on systems where NFC is not an expected workload.
Track kernel package versions across the fleet and alert on hosts running 6.19-rc kernels without the fix commits applied.

How to Mitigate CVE-2026-23167

Immediate Actions Required

Apply the upstream kernel patches that reorder rfkill_unregister() ahead of workqueue destruction in nci_unregister_device().
Update to a stable kernel release containing the fix commits referenced by the Linux stable tree.
Restrict local access to systems exposing virtual NCI devices and /dev/rfkill to trusted users only.

Patch Information

The fix is distributed across multiple Linux stable branches. Refer to the upstream commits: Kernel Git Commit 126cd30c, Kernel Git Commit 546eba0b, Kernel Git Commit 8ea4d964, Kernel Git Commit c3369fc5, Kernel Git Commit cd4412d5, Kernel Git Commit d2492688, and Kernel Git Commit eaa5da51. The fix splits nfc_unregister_device() so rfkill interfaces are removed before nci_close_device() runs.

Workarounds

Blacklist the nfc and nci kernel modules on systems that do not require NFC functionality.
Tighten permissions on /dev/rfkill and virtual NCI device nodes through udev rules to restrict write access.
Disable loading of the virtual_ncidev module where it is not operationally needed.

bash

# Configuration example: blacklist NFC modules until patching is complete
echo 'blacklist nfc' | sudo tee /etc/modprobe.d/disable-nfc.conf
echo 'blacklist nci' | sudo tee -a /etc/modprobe.d/disable-nfc.conf
echo 'blacklist virtual_ncidev' | sudo tee -a /etc/modprobe.d/disable-nfc.conf
sudo update-initramfs -u