The vulnerability is a memory leak in the Linux kernel’s NFC LLCP implementation. During the construction of an SDREQ TLV list, several error paths—nested attribute parsing failures, memory allocation exhaustion, and send failures—skip the cleanup of queued nodes. The leaked kernel memory is not directly exposed to user space and does not provide code execution or data disclosure, but it can accumulate over time and potentially exhaust kernel memory, degrading system performance.

All Linux kernel builds that include the NFC LLCP subsystem are affected. The vendor information identifies the product as "Linux:Linux," indicating that the issue is present across mainstream Linux distributions that compile the native NFC driver before the patch that introduces the free_list cleanup routine.

The CVSS score of 3.3 and an EPSS score of < 1% suggest a low to moderate threat level, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending malformed SDREQ messages over an NFC interface, which an attacker could do locally or remotely if the NFC service is reachable. This inference is made because the description references nested attribute parsing and send failures, which would be triggered by malformed network payloads. Exploitation would require repeated failures to cause significant memory consumption, potentially leading to a denial‑of‑service condition. No public exploits are known.