Linux CVE-2026-23372

Requires authenticated local access with sufficient privileges to create NFC raw sockets (typically requires CAP_NET_RAW capability or membership in specific device access groups like 'nfc' on some distributions). System must have NFC hardware present or NFC kernel modules loaded (nfc.ko, nci.ko). Exploitation depends on winning a narrow race condition between process termination (socket teardown) and asynchronous workqueue execution, which may require multiple attempts but is achievable with low complexity (AC:L) through process lifecycle manipulation. Attack is NOT remotely exploitable (AV:L) and does NOT work against systems with NFC subsystem disabled, modules blacklisted, or without NFC device nodes accessible to the attacker's user context. User interaction is not required (UI:N) once the attacker has local shell access.

Real-world risk is LIMITED despite the HIGH CVSS 7.8 score. CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local attack requiring authenticated low-privilege user access with low complexity, but EPSS score of 0.02% (6th percentile) suggests minimal observed exploitation activity. No CISA KEV listing confirms this is not actively exploited in the wild. The vulnerability requires local authenticated access to NFC-enabled systems and the ability to open NFC raw sockets, which typically requires specific permissions or group membership (often restricted to privileged users in practice). Attack complexity is low once access is obtained, but the attack surface is narrow - limited to systems with NFC hardware, loaded NFC kernel modules, and applications actively using raw NFC sockets. The use-after-free can achieve arbitrary code execution in kernel context (C:H/I:H/A:H), making this a complete system compromise if successfully exploited. However, Debian tracking this across 8 releases and patches available in all active stable branches (6.1 LTS through 7.0 mainline) indicate good patch coverage. Priority should be MEDIUM for NFC-enabled edge devices, IoT gateways, and mobile/embedded systems where local access models differ from traditional servers. For server infrastructure without NFC hardware or with NFC modules blacklisted, risk is NEGLIGIBLE. The 14-year code age (since kernel 3.1) without prior exploitation suggests low in-the-wild feasibility despite technical severity.

An authenticated local attacker with low privileges on an NFC-enabled Linux system opens an NFC raw socket and initiates data transmission to queue tx_work on the system workqueue. The attacker immediately sends SIGKILL to their own process, triggering abrupt socket teardown in rawsock_release() before tx_work executes. The race condition causes tx_work to access freed socket and NFC device structures, resulting in use-after-free memory corruption. The attacker can potentially control freed memory contents through heap spraying techniques to redirect execution flow and achieve arbitrary kernel code execution with full system privileges. No public exploit code identified at time of analysis, but the race window and memory corruption primitive are well-understood exploit techniques for local privilege escalation.