The Linux kernel’s NFC NCI subsystem contains a flaw where nci_transceive() accepts a socket buffer from the caller and is responsible for freeing it on normal return, but when the function exits due to protocol, input validation, or busy errors it fails to release the buffer. This omission results in unreleased kernel memory, as identified by kmemleak, and exemplifies the CWE-401 and CWE-772 weaknesses. Over time repeated invocations of these error paths can consume system memory, potentially leading to instability or crashes, but do not provide a remote code execution path.

Any Linux kernel build that incorporates the unpatched NFC NCI driver is affected; all kernel versions prior to the commit that implements the fix are vulnerable. The provided CPE strings indicate that kernels from 3.2 onward, including early release candidates of 7.0, are at risk, meaning many embedded devices and general-purpose systems that enable NFC support could be impacted.

The EPSS score indicates less than 1% probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited active targeting. Based on the description, the likely attack vector is a local or device‑level attacker sending malformed NFC frames or triggering the NIPA selftest to repeatedly exercise the error paths. While there is no remote code execution capability, persistent memory exhaustion can lead to a denial‑of‑service condition. The CVSS score of 5.5 reflects this moderate severity.