nfc: nci: Fix race between rfkill and nci_unregister_device().

{
  "id": "2b4299466216e5799618220e3b41350412e396bd1bc3877e0c35e30959519dcb",
  "url": "https://osv.dev/vulnerability/CVE-2026-23167",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "nfc: nci: Fix race between rfkill and nci_unregister_device().",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix race between rfkill and nci_unregister_device(). syzbot reported the splat below [0] without a repro. It indicates that struct nci_dev.cmd_wq had been destroyed before nci_close_device() was called via rfkill. nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which (I think) was called from virtual_ncidev_close() when syzbot close()d an fd of virtual_ncidev. The problem is that nci_unregister_device() destroys nci_dev.cmd_wq first and then calls nfc_unregister_device(), which removes the device from rfkill by rfkill_unregister(). So, the device is still visible via rfkill even after nci_dev.cmd_wq is destroyed. Let's unregister the device from rfkill first in nci_unregister_device(). Note that we cannot call nfc_unregister_device() before nci_close_device() because 1) nfc_unregister_device() calls device_del() which frees all memory allocated by devm_kzalloc() and linked to ndev->conn_info_list 2) nci_rx_work() could try to queue nci_conn_info to ndev->conn_info_list which could be leaked Thus, nfc_unregister_device() is split into two functions so we can remove rfkill interfaces only before nci_close_device(). [0]: DEBUG_LOCKS_WARN_ON(1) WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4854 [inline], CPU#0: syz.0.8675/6349 WARNING: ker",
    "evidence": "osv:CVE-2026-23167",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.249",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.199",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.162",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.123",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.69",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.9",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-23167",
      "aliases": [
        "CVE-2026-23167"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6a2968aaf50c7a22fced77a5e24aa636281efca8"
                },
                {
                  "fixed": "cd4412d5905ee580e96c48360dc98fcd9e6f3208"
                },
                {
                  "fixed": "eaa5da5130deda26420273d4610cf6e4f794ed75"
                },
                {
                  "fixed": "8ea4d96419fb20f15a52ce657d49f1e7c91eb7ac"
                },
                {
                  "fixed": "546eba0b10989de9ccc7fd619e874a30561e2b88"
                },
                {
                  "fixed": "126cd30cad37bc7c2c85fe2df2a522d4edf0a5c5"
                },
                {
                  "fixed": "c3369fc5e6120a72169e71acd72e987907a682af"
                },
                {
                  "fixed": "d2492688bb9fed6ab6e313682c387ae71a66ebae"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23167.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.2.0"
                },
                {
                  "fixed": "5.10.249"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.199"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.162"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.123"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.69"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.9"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23167.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.865016322Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/126cd30cad37bc7c2c85fe2df2a522d4edf0a5c5",
        "https://git.kernel.org/stable/c/546eba0b10989de9ccc7fd619e874a30561e2b88",
        "https://git.kernel.org/stable/c/8ea4d96419fb20f15a52ce657d49f1e7c91eb7ac",
        "https://git.kernel.org/stable/c/c3369fc5e6120a72169e71acd72e987907a682af",
        "https://git.kernel.org/stable/c/cd4412d5905ee580e96c48360dc98fcd9e6f3208",
        "https://git.kernel.org/stable/c/d2492688bb9fed6ab6e313682c387ae71a66ebae",
        "https://git.kernel.org/stable/c/eaa5da5130deda26420273d4610cf6e4f794ed75",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23167.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-23167",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23167.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-23167",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 493148,
  "published_at": "2026-02-14T16:01:30.755+00:00"
}