The flaw resides in the Linux kernel’s NFC NCI subsystem. In nci_transceive() the socket buffer passed by the caller is owned, but when the function returns due to protocol, input validation, or busy errors the buffer is not freed. This omission creates a memory leak that kmemleak reports as an unreleased object. The issue exemplifies CWE‑772, unaligned resource release, and can permit an attacker to exhaust system memory over time, potentially destabilizing the system or causing crashes.

The vulnerability is in the core Linux kernel, specifically the NFC NCI driver component. Any Linux kernel build that contains the unpatched nci_driver is affected; versions prior to the commit that introduces the fix are vulnerable. Since the description mentions the nci_dev selftest and NIPA, modules that enable NFC for embedded devices are impacted. Users should verify whether their kernel version predates the patch and consider the system at risk.

The EPSS score indicates a likelihood of less than 1% for exploitation, and the flaw is not listed in the CISA KEV catalog, implying limited active targeting. Exploitation would require triggering the error paths, for example by sending malformed NFC frames or exercising the NIPA selftest. An attacker with sufficient local or device-level access could repeatedly invoke the path, steadily depleting system memory. While no remote code execution is possible, persistent memory exhaustion can lead to a denial‑of‑service condition.