CVE-2026-23291 - Vulnerability Details

- nfc: pn533: properly drop the usb interface reference on disconnect

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: properly drop the usb interface reference on disconnect

When the device is disconnected from the driver, there is a "dangling"
reference count on the usb interface that was grabbed in the probe
callback. Fix this up by properly dropping the reference after we are
done with it.

Published: 2026-03-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The NFC PN533 driver in the Linux kernel does not release the USB interface reference when the device is disconnected, leaving a dangling reference count. This improper reference counting, identified as CWE‑911, can corrupt kernel memory and cause system instability, potentially resulting in a kernel crash.

Affected Systems

All Linux kernels that include the unpatched PN533 driver are affected, including the mainline kernel and the 7.0‑rc1 release, as indicated by the CPE entries for Linux:Linux.

Risk and Exploitability

The CVSS score of 5.5 categorizes this flaw as moderate in severity. The EPSS score of less than 1 % and its absence from the CISA KEV catalog suggest a low probability of active exploitation. Based on the description, it is inferred that an attacker would need local or physical access to trigger a disconnect and exploit the dangling reference; no public exploit has been reported.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c46ee38620a2aa2b25b16bc9738ace80dbff76a4`	affected	< 6645b030b0c1fc5bf338bffb0044238f24b2f770
`c46ee38620a2aa2b25b16bc9738ace80dbff76a4`	affected	< 5be8aa2bcfb53158436182db8dee9d0b8e5901e6
`c46ee38620a2aa2b25b16bc9738ace80dbff76a4`	affected	< 7398d6570501edc55a50ece820f369ab3c1df2e7
`c46ee38620a2aa2b25b16bc9738ace80dbff76a4`	affected	< d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0
`c46ee38620a2aa2b25b16bc9738ace80dbff76a4`	affected	< 7ff14eb070f0efecb2606f8d7aa01b77d188e886
`c46ee38620a2aa2b25b16bc9738ace80dbff76a4`	affected	< 00477cab053dc4816b99141d8fcca7a479cfebeb
`c46ee38620a2aa2b25b16bc9738ace80dbff76a4`	affected	< 4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74
`c46ee38620a2aa2b25b16bc9738ace80dbff76a4`	affected	< 12133a483dfa832241fbbf09321109a0ea8a520e

Linux

affected

Version	Status	Constraints
`3.1`	affected	—
`0`	unaffected	< 3.1
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c46ee38620a2aa2b25b16bc9738ace80dbff76a4,7398d6570501edc55a50ece820f369ab3c1df2e7)`	affected	code_commit	—
`[c46ee38620a2aa2b25b16bc9738ace80dbff76a4,d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0)`	affected	code_commit	—
`[c46ee38620a2aa2b25b16bc9738ace80dbff76a4,7ff14eb070f0efecb2606f8d7aa01b77d188e886)`	affected	code_commit	—
`[c46ee38620a2aa2b25b16bc9738ace80dbff76a4,00477cab053dc4816b99141d8fcca7a479cfebeb)`	affected	code_commit	—
`[c46ee38620a2aa2b25b16bc9738ace80dbff76a4,4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74)`	affected	code_commit	—
`[c46ee38620a2aa2b25b16bc9738ace80dbff76a4,12133a483dfa832241fbbf09321109a0ea8a520e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.1`	affected	semver	—
`[0,3.1)`	unaffected	semver	—
`[6.1.167,7.0.0)`	unaffected	semver	—
`[6.6.130,7.0.0)`	unaffected	semver	—
`[6.12.77,7.0.0)`	unaffected	semver	—
`[6.18.17,7.0.0)`	unaffected	semver	—
`[6.19.7,7.0.0)`	unaffected	semver	—
`[7.0-rc2,*]`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that includes the patched PN533 driver
If an upgrade is not feasible, unload or blacklist the pn533 NFC module to avoid the dangling reference scenario
Monitor kernel logs for USB disconnect events or kernel oops messages and configure alerts to detect potential instability early

Generated by OpenCVE AI on May 29, 2026 at 20:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DLA	DLA-4606-1	linux security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00031.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb
https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e
https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74
https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6
https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770
https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7
https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886
https://git.kernel.org/stable/c/d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0
https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23291-eae3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23291
https://www.cve.org/CVERecord?id=CVE-2026-23291

History

Fri, 29 May 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5be8aa2bcfb53158436182db8dee9d0b8e5901e6 https://git.kernel.org/stable/c/6645b030b0c1fc5bf338bffb0044238f24b2f770

Thu, 26 Mar 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-754 CWE-772

Thu, 26 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23291-eae3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23291 https://www.cve.org/CVERecord?id=CVE-2026-23291

Wed, 25 Mar 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-754 CWE-772

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbed in the probe callback. Fix this up by properly dropping the reference after we are done with it.
Title		nfc: pn533: properly drop the usb interface reference on disconnect
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74 https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7 https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886 https://git.kernel.org/stable/c/d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-25T10:26:49.634Z

Updated: 2026-05-11T22:04:02.263Z

Reserved: 2026-01-13T15:37:45.992Z

Link: CVE-2026-23291

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-03-25T11:16:24.197

Modified: 2026-05-29T15:07:47.390

Link: CVE-2026-23291

Redhat

Severity :

Publid Date: 2026-03-25T00:00:00Z

Links: CVE-2026-23291 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-29T20:30:07Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object