CVE-2026-23339

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfc: nci: free skb on nci_transceive early error paths<br /> <br /> nci_transceive() takes ownership of the skb passed by the caller,<br /> but the -EPROTO, -EINVAL, and -EBUSY error paths return without<br /> freeing it.<br /> <br /> Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes<br /> the nci/nci_dev selftest hits the error path occasionally in NIPA,<br /> and kmemleak detects leaks:<br /> <br /> unreferenced object 0xff11000015ce6a40 (size 640):<br /> comm "nci_dev", pid 3954, jiffies 4295441246<br /> hex dump (first 32 bytes):<br /> 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk<br /> 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk<br /> backtrace (crc 7c40cc2a):<br /> kmem_cache_alloc_node_noprof+0x492/0x630<br /> __alloc_skb+0x11e/0x5f0<br /> alloc_skb_with_frags+0xc6/0x8f0<br /> sock_alloc_send_pskb+0x326/0x3f0<br /> nfc_alloc_send_skb+0x94/0x1d0<br /> rawsock_sendmsg+0x162/0x4c0<br /> do_syscall_64+0x117/0xfc0