CVE-2026-23291

Vulnerability

In the Linux kernel's NFC subsystem, the pn533 driver fails to properly drop the USB interface reference that was acquired during probe when the device is disconnected. This creates a dangling reference count on the USB interface, which can lead to a use-after-free condition if the interface is later removed while the driver still holds a reference [1][2].

Exploitation

An attacker with physical access to the system could exploit this by repeatedly connecting and disconnecting a malicious NFC device that triggers the pn533 driver. The dangling reference prevents the USB interface from being properly cleaned up, potentially allowing the attacker to cause memory corruption or a kernel crash [3][4].

Impact

Successful exploitation could lead to a denial of service (system crash) or, in more severe cases, arbitrary code execution in the kernel context. The vulnerability is triggered during device disconnect, making it a local attack vector that requires physical presence or the ability to hot-plug USB devices.

Mitigation

The fix has been applied in the Linux kernel stable tree, with commits that properly drop the USB interface reference after disconnect [1][2][3][4]. Users should update to a kernel version containing these patches to mitigate the vulnerability.