What is the CVSS score of CVE-2026-23330?

CVE-2026-23330 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23330?

Yes, a patch is available for CVE-2026-23330. Update the affected software to the latest version immediately.

Linux CVE-2026-23330

EUVD-2026-15287 MEDIUM

Memory Leak (CWE-401)

2026-03-25 Linux

GHSA-vjm5-v2mx-wqmv

Information Disclosure Linux Microsoft

5.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-401 ASVS 5.0 V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Impact	This vulnerability presents a moderate to significant local denial of service risk despite the absence of CVSS and EPSS metrics. The attack vector is local (requires access to NFC functionality), and while the technical complexity is medium (requires understanding NFC device lifecycle), the impact is tangible: repeated memory leaks can exhaust system memory and crash the kernel. The presence of three distinct kernel commits in the stable branches (git.kernel.org references) indicates this was treated as a legitimate fix requiring backporting, suggesting the kernel maintainers considered it important enough for stable releases. However, the lack of evidence of public exploitation and the requirement for local access limit the immediate risk compared to remote vulnerabilities. The deterministic nature of the leak (triggered by specific device close sequences) makes this automatable by a local attacker with NFC access permissions. Organizations running NFC-enabled systems or embedded Linux devices with NFC hardware should prioritize patching, while general-purpose servers without NFC hardware are at minimal risk.
Exploit ScenarioDerived	An attacker with local access to an NFC-enabled Linux system repeatedly opens and closes NFC devices through the socket API without properly completing pending data exchange operations. Each close operation leaks approximately 2048 bytes of kernel memory (as shown in the backtrace), and performing this operation hundreds or thousands of times exhausts available kernel memory. Within minutes to hours depending on system configuration, the accumulated memory leak causes the kernel to fail memory allocation requests, triggering an out-of-memory condition that crashes the system or forces the kernel to terminate processes via the OOM killer. No proof-of-concept code needs to be sophisticated—simple userspace code calling socket(), connect(), and close() on NFC raw sockets in a loop is sufficient to trigger the leak.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A memory leak vulnerability exists in the Linux kernel's NFC (Near Field Communication) NCI subsystem where pending data exchange operations are not properly completed when a device is closed, causing socket references to be held indefinitely. This affects all Linux kernel versions with the vulnerable NFC NCI code path. An attacker with local access to NFC functionality could trigger repeated device close operations to exhaust memory resources, leading to denial of service. While no CVSS score or EPSS data is currently available, the issue is being actively addressed through kernel patches as evidenced by multiple commit references.

RemediationAI

Linux users should upgrade their kernel to a version that includes one of the three referenced commits: 91ff0d8c3464da7f0c43da38c195e60b660128bf, d05f55d68ebdebb2b0a8480d766eaae88c8c92de, or 66083581945bd5b8e99fe49b5aeb83d03f62d053. For most users, this means upgrading to the latest stable kernel release for your supported series (kernel.org provides stable kernel releases). Distributions typically backport these patches automatically; users should apply their distribution's latest kernel updates through standard package management. For systems where kernel upgrades cannot be immediately applied, disable NFC functionality if not required via kernel module blacklisting (adding nfc and nci entries to /etc/modprobe.d/blacklist.conf) or BIOS/firmware settings. Monitor system memory usage on NFC-enabled systems to detect potential memory exhaustion attacks. The fixes are available at git.kernel.org as referenced in the advisory commits.

Affected VersionsENISA

Linux patch: 0

Linux 38f04c6b1b682f1879441e2925403ad9aff9e229 <d05f55d68ebdebb2b0a8480d766eaae88c8c92de

Linux 38f04c6b1b682f1879441e2925403ad9aff9e229 <91ff0d8c3464da7f0c43da38c195e60b660128bf

Linux 3.2

Linux patch: 6.19.7

Linux patch: 7.0-rc3

Linux 38f04c6b1b682f1879441e2925403ad9aff9e229 <66083581945bd5b8e99fe49b5aeb83d03f62d053

Linux patch: 6.18.17

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the NFC (Near Field Communication) NCI (NCI protocol) subsystem of the Linux kernel, specifically in the nci_close_device() function. The NFC subsystem provides kernel-level support for NFC operations, and the NCI layer implements the standardized NCI protocol. The root cause is a resource management failure (related to CWE-401: Missing Release of Memory after Effective Lifetime) where data exchange callbacks such as rawsock_data_exchange_complete() maintain socket references that are never released when the device closes without explicit completion of pending operations. The backtrace shows socket allocation through the rawsock_create() path in the NFC raw socket implementation, indicating that improperly released socket objects accumulate in kernel memory. The affected CPE is cpe:2.3:a:linux:linux, indicating the vulnerability affects the Linux kernel itself across all architectures and configurations that include NFC functionality.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE 5.2 MEDIUM

Red Hat MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 21:27 NVD

5.5 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 25, 2026 - 10:27 nvd

N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: complete pending data exchange on device close

In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference.

NIPA occasionally hits this leak:

unreferenced object 0xff1100000f435000 (size 2048): comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc ec2b3c5): __kmalloc_noprof+0x4db/0x730 sk_prot_alloc.isra.0+0xe4/0x1d0 sk_alloc+0x36/0x760 rawsock_create+0xd1/0x540 nfc_sock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0x117/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2025-25469 HIGH POC

8.8

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	5.10.223-1	-
bullseye (security)	vulnerable	5.10.251-1	-
bookworm	vulnerable	6.1.159-1	-
bookworm (security)	vulnerable	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23330 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/?id.353078 REF https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053 REF https://git.kernel.org/stable/c/702029337b057085ea13f964822dcd95e0fe53f5 REF https://git.kernel.org/stable/c/75fdb22ef0635c02337de0c08c98f93f37b5cbee REF https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf REF https://git.kernel.org/stable/c/9df613ef6e8e873cdab969a11f74823488977f1f REF https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back