CVE-2026-23339

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: free skb on nci_transceive early error paths

nci_transceive() takes ownership of the skb passed by the caller,

but the -EPROTO, -EINVAL, and -EBUSY error paths return without

freeing it.

Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes

the nci/nci_dev selftest hits the error path occasionally in NIPA,

and kmemleak detects leaks:

unreferenced object 0xff11000015ce6a40 (size 640):

comm "nci_dev", pid 3954, jiffies 4295441246

hex dump (first 32 bytes):

6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk

6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk

backtrace (crc 7c40cc2a):

kmem_cache_alloc_node_noprof+0x492/0x630

__alloc_skb+0x11e/0x5f0

alloc_skb_with_frags+0xc6/0x8f0

sock_alloc_send_pskb+0x326/0x3f0

nfc_alloc_send_skb+0x94/0x1d0

rawsock_sendmsg+0x162/0x4c0

do_syscall_64+0x117/0xfc0