---
id: CVE-2026-23330
title: 'nfc: nci: complete pending data exchange on device close'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfc: nci: complete pending data exchange on device close

  In nci_close_device(), complete any pending data exchange before
  closing. The data exchange callback (e.g.
  raw…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 <
    75fdb22ef0635c02337de0c08c98f93f37b5cbee
  - >-
    Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 <
    9df613ef6e8e873cdab969a11f74823488977f1f
  - >-
    Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 <
    702029337b057085ea13f964822dcd95e0fe53f5
  - >-
    Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 <
    91ff0d8c3464da7f0c43da38c195e60b660128bf
  - >-
    Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 <
    d05f55d68ebdebb2b0a8480d766eaae88c8c92de
  - >-
    Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 <
    66083581945bd5b8e99fe49b5aeb83d03f62d053
  - Linux 3.2
published: '2026-03-25'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:23:57.014Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23330'
references:
  - url: 'https://git.kernel.org/stable/c/75fdb22ef0635c02337de0c08c98f93f37b5cbee'
  - url: 'https://git.kernel.org/stable/c/9df613ef6e8e873cdab969a11f74823488977f1f'
  - url: 'https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5'
  - url: 'https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf'
  - url: 'https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de'
  - url: 'https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02418
ingestedAt: '2026-11-05T15:02:32.201Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: complete pending data exchange on device close

In nci_close_device(), complete any pending data exchange before
closing. The data exchange callback (e.g.
rawsock_data_exchange_complete) holds a socket reference.

NIPA occasionally hits this leak:

unreferenced object 0xff1100000f435000 (size 2048):
  comm "nci_dev", pid 3954, jiffies 4295441245
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  '..@............
  backtrace (crc ec2b3c5):
    __kmalloc_noprof+0x4db/0x730
    sk_prot_alloc.isra.0+0xe4/0x1d0
    sk_alloc+0x36/0x760
    rawsock_create+0xd1/0x540
    nfc_sock_create+0x11f/0x280
    __sock_create+0x22d/0x630
    __sys_socket+0x115/0x1d0
    __x64_sys_socket+0x72/0xd0
    do_syscall_64+0x117/0xfc0
    entry_SYSCALL_64_after_hwframe+0x4b/0x53

## Affected

- `Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 < 75fdb22ef0635c02337de0c08c98f93f37b5cbee`
- `Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 < 9df613ef6e8e873cdab969a11f74823488977f1f`
- `Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 < 702029337b057085ea13f964822dcd95e0fe53f5`
- `Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 < 91ff0d8c3464da7f0c43da38c195e60b660128bf`
- `Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 < d05f55d68ebdebb2b0a8480d766eaae88c8c92de`
- `Linux >= 38f04c6b1b682f1879441e2925403ad9aff9e229 < 66083581945bd5b8e99fe49b5aeb83d03f62d053`
- `Linux 3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.