Executive brief
A vulnerability was identified in the Linux kernel's support for certain NXP Near Field Communication (NFC) devices. When these devices are disconnected, the system fails to properly release internal tracking records, leading to a resource leak. This could allow a local user to cause a system crash or instability, potentially disrupting operations that rely on the affected hardware.
Technical details
A reference counting error exists in the pn533 NFC driver (drivers/nfc/pn533/usb.c) within the Linux kernel. The vulnerability occurs because the driver increments a reference count on the USB interface during the 'probe' phase but fails to decrement it via 'usb_put_dev' during the 'disconnect' phase. This results in a 'dangling' reference count that prevents the proper cleanup of resources when the device is removed. A local attacker with the ability to trigger device disconnection events could exploit this to cause a kernel resource leak, eventually leading to a denial of service (system instability or crash). The issue has been patched across multiple stable kernel branches by adding the missing 'usb_put_dev(phy->udev)' call in the 'pn533_usb_disconnect' function.
Affected products
- Linux Linux Kernel 3.1 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-03-25: disclosed
- 2026-03-25: advisory
- 2026-02-25: patched: Initial patch commit in stable tree
References
- https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb
- https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e
- https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74
- https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6
- https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770
- https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7
- https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886