CVE-2023-53298

nfc: fix memory leak of se_io context in nfc_genl_se_io

MEDIUM
5.5
CVSS Score
Published: September 16, 2025 at 08:11 AM UTC
Updated: June 17, 2026 at 06:44 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: fix memory leak of se_io context in nfc_genl_se_io The callback context for sending/receiving APDUs to/from the selected secure element is allocated inside nfc_genl_se_io and supposed to be eventually freed in se_io_cb callback function. However, there are several error paths where the bwi_timer is not charged to call se_io_cb later, and the cb_context is leaked. The patch proposes to free the cb_context explicitly on those error paths. At the moment we can't simply check 'dev->ops->se_io()' return value as it may be negative in both cases: when the timer was charged and was not.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.13 ≤ v < 4.14.3083.13 ≤ v < 4.19.2763.13 ≤ v < 5.10.1733.13 ≤ v < 5.15.1003.13 ≤ v < 5.4.2353.13 ≤ v < 6.1.183.13 ≤ v < 6.2.53.13 ≤ v < 6.34.15 ≤ v < 4.19.2764.20 ≤ v < 5.4.2355.11 ≤ v < 5.15.1005.16 ≤ v < 6.1.185.5 ≤ v < 5.10.1736.2 ≤ v < 6.2.53.135ce3f32b5264b337bfd13a780452a17705307725
Vendor states this is fixed in 25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea (fixed)
Vendor states this is fixed in 271eed1736426103335c5aac50f15b0f4d236bc0 (fixed)
Vendor states this is fixed in 5321da6d84b87a34eea441677d649c34bd854169 (fixed)
Vendor states this is fixed in 8978315cb4bf8878c9c8ec05dafd8f7ff539860d (fixed)
Vendor states this is fixed in af452e35b9e6a87cd49e54a7a3d60d934b194651 (fixed)
Vendor states this is fixed in b2036a252381949d3b743a3de069324ae3028a57 (fixed)
Vendor states this is fixed in ba98db08895748c12e5ded52cd1598dce2c79e55 (fixed)
Vendor states this is fixed in c494365432dcdc549986f4d9af9eb6190cbdb153 (fixed)
Vendor states this is fixed in 3.13 (unaffected)
Vendor states this is fixed in 4.14.308 (unaffected)
Vendor states this is fixed in 4.19.276 (unaffected)
Vendor states this is fixed in 5.10.173 (unaffected)
Vendor states this is fixed in 5.15.100 (unaffected)
Vendor states this is fixed in 5.4.235 (unaffected)
Vendor states this is fixed in 6.1.18 (unaffected)
Vendor states this is fixed in 6.2.5 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)

References (8)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/271eed1736426103335c5aac50f15b0f4d236bc0
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5321da6d84b87a34eea441677d649c34bd854169
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8978315cb4bf8878c9c8ec05dafd8f7ff539860d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/af452e35b9e6a87cd49e54a7a3d60d934b194651
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b2036a252381949d3b743a3de069324ae3028a57
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ba98db08895748c12e5ded52cd1598dce2c79e55
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c494365432dcdc549986f4d9af9eb6190cbdb153

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card