The vulnerability arises from a circular locking dependency in the Linux kernel’s NFC NCI subsystem. While closing an NCI device, the code flushes both the rx and tx work queues while still holding the request lock. A worker triggered on the rx queue can simultaneously acquire the request lock, creating a deadlock scenario. An attacker or misbehaving NFC device could trigger this code path, resulting in the kernel hanging or timing out, effectively denying service to NFC operations.

All publicly available Linux kernel builds that include the NFC NCI subsystem prior to the patched code contain this flaw. No specific versions are listed, but the CPE indicates that every Linux kernel is potentially affected. Users of distributions shipping default kernels should verify that their kernel includes the patch that moves the rx queue flush after the request lock is released.

The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting a modest but non-negligible exploitation probability. The attack vector is likely local or device‑based; a compromised NFC device or user with permissions to load NFC drivers could force the deadlock. Once triggered, the system may become unresponsive until rebooted. Given the critical nature of kernel deadlocks, the risk to availability is high and immediate mitigation is recommended.