Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-23167

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix race between rfkill and nci_unregister_device(). syzbot reported the splat below [0] without a repro. It indicates that struct nci_dev.cmd_wq had been destroyed before nci_close_device() was called via rfkill. nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which (I think) was called from virtual_ncidev_close() when syzbot close()d an fd of virtual_ncidev. The problem is that nci_unregister_device
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:cdd89ed3f6ce0fcd8d8843a439d5e7aeab1403ea77fddcd7fc450354f4968a1b
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/nfc/nfc.h","net/nfc/core.c","net/nfc/nci/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cd4412d5905ee580e96c48360dc98fcd9e6f3208","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"eaa5da5130deda26420273d4610cf6e4f794ed75","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"8ea4d96419fb20f15a52ce657d49f1e7c91eb7ac","status":"affecte…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/nfc/nfc.h","net/nfc/core.c","net/nfc/nci/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.249","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.199","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/nfc/nfc.h","net/nfc/core.c","net/nfc/nci/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cd4412d5905ee580e96c48360dc98fcd9e6f3208","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"eaa5da5130deda26420273d4610cf6e4f794ed75","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"8ea4d96419fb20f15a52ce657d49f1e7c91eb7ac","status":"affecte…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/nfc/nfc.h","net/nfc/core.c","net/nfc/nci/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.249","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.199","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/affected/1

Source references

7 source assertions
{"url":"https://git.kernel.org/stable/c/126cd30cad37bc7c2c85fe2df2a522d4edf0a5c5"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/546eba0b10989de9ccc7fd619e874a30561e2b88"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/8ea4d96419fb20f15a52ce657d49f1e7c91eb7ac"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/c3369fc5e6120a72169e71acd72e987907a682af"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/cd4412d5905ee580e96c48360dc98fcd9e6f3208"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/d2492688bb9fed6ab6e313682c387ae71a66ebae"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/eaa5da5130deda26420273d4610cf6e4f794ed75"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:80d32721c6467c4d7b3618f27a20725cd31f039320dd509c82cd2994f36d0695 · sha256:288bce7b6725708c… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer