CVE-2026-23291

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbed in the probe callback. Fix this up by properly dropping the reference after we are done with it.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb	Patch
https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e	Patch
https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74	Patch
https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6	Patch
https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770	Patch
https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7	Patch
https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886	Patch
https://git.kernel.org/stable/c/d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::

History

No history.

Information

Published : 2026-03-25 11:16

Updated : 2026-06-17 10:21

NVD link : CVE-2026-23291

Mitre link : CVE-2026-23291

CVE.ORG link : CVE-2026-23291

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-Other

{"id": "CVE-2026-23291", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4", "lessThan": "6645b030b0c1fc5bf338bffb0044238f24b2f770", "versionType": "git"}, {"status": "affected", "version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4", "lessThan": "5be8aa2bcfb53158436182db8dee9d0b8e5901e6", "versionType": "git"}, {"status": "affected", "version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4", "lessThan": "7398d6570501edc55a50ece820f369ab3c1df2e7", "versionType": "git"}, {"status": "affected", "version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4", "lessThan": "d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0", "versionType": "git"}, {"status": "affected", "version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4", "lessThan": "7ff14eb070f0efecb2606f8d7aa01b77d188e886", "versionType": "git"}, {"status": "affected", "version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4", "lessThan": "00477cab053dc4816b99141d8fcca7a479cfebeb", "versionType": "git"}, {"status": "affected", "version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4", "lessThan": "4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74", "versionType": "git"}, {"status": "affected", "version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4", "lessThan": "12133a483dfa832241fbbf09321109a0ea8a520e", "versionType": "git"}], "programFiles": ["drivers/nfc/pn533/usb.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"status": "unaffected", "version": "0", "lessThan": "3.1", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.77", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/nfc/pn533/usb.c"], "defaultStatus": "affected"}]}], "published": "2026-03-25T11:16:24.197", "references": [{"url": "https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: properly drop the usb interface reference on disconnect\n\nWhen the device is disconnected from the driver, there is a \"dangling\"\nreference count on the usb interface that was grabbed in the probe\ncallback. Fix this up by properly dropping the reference after we are\ndone with it."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnfc: pn533: soltar correctamente la referencia de la interfaz USB al desconectarse\n\nCuando el dispositivo se desconecta del controlador, hay un contador de referencias 'colgante' en la interfaz USB que fue obtenida en la funci\u00f3n de devoluci\u00f3n de llamada de sondeo. Solucionar esto soltando correctamente la referencia despu\u00e9s de que hayamos terminado con ella."}], "lastModified": "2026-06-17T10:21:16.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "347BDDE9-6DB3-4F21-865D-FEC08136F2CD", "versionEndExcluding": "5.10.253", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5", "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}