PT-2026-27695 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-05-10 · CVE-2026-23330

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains an issue within the Near Field Communication (NFC) subsystem related to incomplete data exchange handling during device closure. Specifically, the nci close device() function does not fully complete any pending data exchange before closing, potentially leading to a memory leak. This leak occurs because the data exchange callback function, such as rawsock data exchange complete(), holds a reference to a socket. The issue is observed in scenarios involving NIPA and can result in unreferenced objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-23330

ECHO-4358-8DA1-DCB5

Affected Products

Linux Kernel

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23330.json · Exploit
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23330 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-23330 · Vendor Advisory
• https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5 · Patch
• https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053 · Patch
• https://ubuntu.com/security/CVE-2026-23330 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23330 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23330 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23330 · Vendor Advisory
• https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23330 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23330 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23330 · Vendor Advisory
• https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf · Patch