CVE-2026-23339: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23339 Overview

CVE-2026-23339 is a memory leak vulnerability in the Linux kernel's NFC (Near Field Communication) NCI (NFC Controller Interface) subsystem. The vulnerability exists in the nci_transceive() function, which takes ownership of an skb (socket buffer) passed by the caller but fails to properly free it on certain early error paths, specifically when returning -EPROTO, -EINVAL, or -EBUSY errors.

This memory leak was detected through kernel memory leak detection (kmemleak) during self-testing of the nci/nci_dev module, where issues clearing NCI_DATA_EXCHANGE caused the error paths to be triggered occasionally.

Critical Impact

Unreferenced memory objects (640 bytes each) accumulate over time when the NCI transceive error paths are triggered, potentially leading to resource exhaustion and denial of service conditions on systems utilizing NFC functionality.

Affected Products

• Linux kernel (NFC/NCI subsystem)
• Systems with NFC hardware utilizing the NCI driver stack
• Affected stable kernel branches (multiple versions patched)

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23339 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23339

Vulnerability Analysis

The vulnerability resides in the nci_transceive() function within the Linux kernel's NFC NCI subsystem. When this function is called, it assumes ownership of the socket buffer (skb) passed by the caller. According to proper memory management conventions, the function must either successfully process the buffer or free it if an error occurs.

However, several early error return paths in nci_transceive() fail to call kfree_skb() before returning. When the function encounters -EPROTO (protocol error), -EINVAL (invalid argument), or -EBUSY (device busy) conditions, it returns immediately without freeing the socket buffer, resulting in a memory leak.

The kmemleak backtrace shows the allocation path originates from:

• kmem_cache_alloc_node_noprof() → __alloc_skb() → alloc_skb_with_frags() → sock_alloc_send_pskb() → nfc_alloc_send_skb() → rawsock_sendmsg()

Each leaked object is 640 bytes in size, and repeated triggering of the error conditions can lead to significant memory consumption.

Root Cause

The root cause is incomplete error handling in the nci_transceive() function. The function's design contract specifies that it takes ownership of the skb parameter, meaning it is responsible for freeing the buffer in all code paths—both success and failure. The developer implementing the error handling for the -EPROTO, -EINVAL, and -EBUSY conditions neglected to include the necessary kfree_skb() call before returning from these error paths.

This is a common pattern of memory management bugs in kernel code where ownership semantics require careful tracking of which function is responsible for freeing allocated resources.

Attack Vector

The vulnerability is triggered through the NFC subsystem's socket interface. An attacker with local access could potentially exploit this by:

1. Opening an NFC raw socket via rawsock_sendmsg()
2. Sending crafted messages that cause nci_transceive() to take an early error path
3. Repeatedly triggering the error condition to accumulate leaked memory
4. Eventually exhausting available kernel memory resources

The attack requires local access to the NFC subsystem and the ability to send NFC messages that trigger the specific error conditions. The vulnerability manifests in the NCI data exchange path, particularly when the NCI_DATA_EXCHANGE flag is not properly cleared.

For detailed information about the fix implementation, refer to the Kernel Git Commit.

Detection Methods for CVE-2026-23339

Indicators of Compromise

• Increasing kernel memory consumption without corresponding application activity
• Kmemleak reports showing unreferenced objects with backtraces through nfc_alloc_send_skb() and nci_transceive()
• System log entries indicating NFC/NCI subsystem errors with -EPROTO, -EINVAL, or -EBUSY return codes
• Performance degradation on systems with active NFC communication

Detection Strategies

• Enable kmemleak in kernel configuration (CONFIG_DEBUG_KMEMLEAK) to detect unreferenced memory objects
• Monitor /sys/kernel/debug/kmemleak for entries containing nci_transceive or nfc_alloc_send_skb in backtraces
• Use kernel tracing (ftrace) to monitor nci_transceive() return values for elevated error rates
• Implement memory pressure monitoring on systems with NFC functionality enabled

Monitoring Recommendations

• Set up automated kmemleak scanning on systems with active NFC usage
• Monitor kernel slab allocator statistics for skbuff_head_cache growth anomalies
• Configure alerts for sustained memory consumption increases on NFC-enabled devices
• Review system logs for patterns of repeated NCI transceive failures

How to Mitigate CVE-2026-23339

Immediate Actions Required

• Apply kernel patches from the stable kernel branches that address this vulnerability
• If patching is not immediately possible, consider disabling NFC functionality if not required
• Monitor affected systems for signs of memory exhaustion
• Prioritize patching on systems that actively use NFC communication

Patch Information

The Linux kernel maintainers have released patches across multiple stable kernel branches. The fix ensures that kfree_skb() is called on all error paths in nci_transceive() before returning.

Patch commits are available for multiple kernel versions:

• Kernel Git Commit Update 1
• Kernel Git Commit Update 2
• Kernel Git Commit Update 3
• Kernel Git Commit Update 4
• Kernel Git Commit Update 5
• Kernel Git Commit Update 6

Workarounds

• Disable NFC kernel modules if NFC functionality is not required: modprobe -r nfc nci
• Blacklist NFC modules in /etc/modprobe.d/ to prevent automatic loading
• Implement resource limits and monitoring for systems where patching cannot be immediately performed
• Consider using containerization or namespaces to limit NFC access to trusted processes only

# Disable NFC modules as a temporary workaround
echo "blacklist nfc" >> /etc/modprobe.d/disable-nfc.conf
echo "blacklist nci" >> /etc/modprobe.d/disable-nfc.conf
# Remove currently loaded modules
modprobe -r nci
modprobe -r nfc
# Update initramfs to persist changes
update-initramfs -u