CVE-2026-23330: Linux Kernel NFC NCI Memory Leak Vulnerability

CVE-2026-23330 Overview

A memory leak vulnerability has been identified in the Linux kernel's Near Field Communication (NFC) NCI (NFC Controller Interface) subsystem. The flaw occurs in the nci_close_device() function, which fails to complete pending data exchange operations before closing the NFC device. This results in unreferenced socket objects remaining in kernel memory, leading to a memory leak condition.

Critical Impact
Systems with NFC functionality enabled may experience gradual memory exhaustion due to leaked socket references when NFC devices are repeatedly opened and closed without completing pending data exchanges.

Affected Products

Linux kernel with NFC subsystem enabled
Systems utilizing NCI-based NFC controllers
Devices running NFC rawsock implementations

Discovery Timeline

2026-03-25 - CVE CVE-2026-23330 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23330

Vulnerability Analysis

This memory leak vulnerability resides in the Linux kernel's NFC NCI subsystem, specifically within the device closure path. When an NFC device is closed via nci_close_device(), the function does not properly complete any pending data exchange operations that may be in progress.

The data exchange callback mechanism, such as rawsock_data_exchange_complete(), maintains a reference to a socket object. When the device is closed prematurely without completing the data exchange, this socket reference is never released, resulting in orphaned memory allocations.

The kernel memory leak detection system (NIPA) has observed unreferenced objects of 2048 bytes in size associated with the nci_dev process. The backtrace indicates the leaked memory originates from socket allocation during rawsock_create() operations, flowing through sk_alloc(), sk_prot_alloc(), and __kmalloc_noprof().

Root Cause

The root cause is improper resource cleanup in the NFC NCI subsystem. The nci_close_device() function lacks the necessary logic to signal completion for pending data exchange operations before proceeding with device closure. This design oversight means that any in-flight data exchange callbacks retain their socket references indefinitely, as the completion signal they await never arrives.

The socket allocation call chain (__sys_socket → nfc_sock_create → rawsock_create) creates properly referenced objects, but the corresponding deallocation path is broken when device closure interrupts pending exchanges.

Attack Vector

The attack vector for this vulnerability is currently categorized as unknown. Local access to NFC device operations would typically be required to trigger this condition. An attacker with the ability to repeatedly open NFC devices, initiate data exchanges, and close the devices without completing the exchanges could potentially cause gradual memory exhaustion on the affected system.

The vulnerability manifests in the NCI device management path when socket references held by pending data exchange callbacks are never released. See the kernel commit patches for detailed technical implementation.

Detection Methods for CVE-2026-23330

Indicators of Compromise

Gradual increase in kernel memory usage on systems with active NFC operations
NIPA (kernel memory leak detector) reports showing unreferenced objects from nci_dev processes
Backtrace entries referencing rawsock_create, sk_alloc, and __kmalloc_noprof in leak reports
Socket objects remaining allocated after NFC device closure operations

Detection Strategies

Enable kernel memory leak detection (KMEMLEAK) to identify unreferenced socket objects
Monitor system logs for memory allocation warnings related to NFC subsystem operations
Implement periodic memory auditing for systems with persistent NFC device usage
Review kernel debug logs for incomplete data exchange warnings in the NCI subsystem

Monitoring Recommendations

Deploy memory usage monitoring with alerts for unexpected kernel memory growth
Track NFC device open/close operations and correlate with memory allocation patterns
Monitor for repeated NFC device cycling patterns that may indicate exploitation attempts
Implement system health checks that include NFC subsystem memory footprint analysis

How to Mitigate CVE-2026-23330

Immediate Actions Required

Apply the available kernel patches from the stable kernel tree
Consider temporarily disabling NFC functionality on systems where it is not required
Monitor affected systems for signs of memory exhaustion
Schedule maintenance windows to apply kernel updates on production systems

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that pending data exchange operations are properly completed before the NFC device is closed, allowing socket references to be released correctly.

Patches are available from the following kernel commits:

Workarounds

Disable the NFC kernel module on systems where NFC functionality is not required using modprobe -r nfc or by blacklisting the module
Implement periodic system reboots on affected systems to reclaim leaked memory until patches can be applied
Restrict access to NFC device operations to trusted users and processes only
Monitor and limit the frequency of NFC device open/close operations

bash

# Disable NFC kernel module temporarily
sudo modprobe -r nfc_nci
sudo modprobe -r nfc

# Blacklist NFC modules permanently (add to /etc/modprobe.d/blacklist-nfc.conf)
echo "blacklist nfc" | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo "blacklist nfc_nci" | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf