Executive brief
The Linux kernel's NFC (Near Field Communication) pn533 driver has a memory leak in its device removal cleanup path. When an NFC device is disconnected while transmitting large frames, queued network buffer fragments are not properly released, causing the driver to leak memory. This can gradually consume system memory on devices that frequently use NFC communication.
Technical details
The vulnerability is a resource leak in the pn533 NFC driver's pn53x_common_clean() cleanup function. The function properly purges the resp_q queue before freeing the PN533 driver state, but fails to purge the fragment_skb queue, which holds network buffer (skb) objects used for fragmenting and transmitting large frames. When an NFC device is removed while fragments are queued, these skbs are never freed, resulting in kernel memory leaks. An attacker with local access could exploit this by repeatedly inserting and removing NFC devices during active frame transmission to exhaust system memory. The fix adds a single skb_queue_purge() call for the fragment_skb queue during cleanup. Patches are available in kernel stable branches.
Affected products
- Linux Linux kernel Multiple versions (fixed in various stable branches)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: Fix committed to Linux stable branches