The vulnerability arises from a circular locking dependency in the Linux kernel’s NFC NCI subsystem. While closing an NCI device, the code flushes both the rx and tx work queues while still holding the request lock, allowing a worker on the rx queue to acquire the same lock and cause a deadlock. This misuse of the kernel’s dispatch services also falls under CWE-833, because the subsystem attempts to perform work and lock operations in an improper order, leading to the same deadlock. The flaw also matches CWE-667, which describes deadlocks caused by incorrect lock ordering.

All publicly available Linux kernel builds that include the NFC NCI subsystem prior to the patched code contain this flaw. No specific versions are listed, but the CPE indicates that every Linux kernel is potentially affected. Users of distributions shipping default kernels should verify that their kernel includes the patch that moves the rx queue flush after the request lock is released.

The EPSS score is < 1% (specifically 0.00032) and the flaw is not listed in the CISA KEV catalog, indicating a very low exploitation probability. The CVSS score of 5.5 indicates a medium severity centered on availability. The attack vector is likely local or device-based; a compromised NFC device or user with permissions to load NFC drivers could force the deadlock. Once triggered, the system may become unresponsive until rebooted. Given the critical nature of kernel deadlocks, the risk to availability is high and immediate mitigation is recommended.