Executive brief
A vulnerability was discovered in the Linux kernel's Near Field Communication (NFC) component. The issue involves insufficient validation of data packets, which could allow an attacker to trigger unexpected behavior or access uninitialized memory. This could potentially lead to a system crash or unauthorized access to sensitive information on devices using NFC technology.
Technical details
An uninitialized value vulnerability exists in the Linux kernel's NCI (NFC Controller Interface) implementation within `net/nfc/nci/ntf.c`. The root cause is inadequate input validation in `nic_valid_size()`, which fails to properly verify that the buffer length matches the expected NCI header layout. This allows the kernel to process `skb_buff->data` before it has been properly assigned, leading to the use of uninitialized memory. An attacker with adjacent network access (via NFC) could exploit this to cause a kernel panic or potentially leak information. The fix introduces rigorous length checks in various notification packet handlers (e.g., `nci_core_reset_ntf_packet`) to ensure packets are silently dropped if they do not meet size requirements.
Affected products
- Linux Linux Kernel 3.2 to 6.17.3
Timeline
- 2025-09-25: patched: Initial patch authored by Deepak Sharma
- 2025-10-28: disclosed: CVE-2025-40043 published
References
- https://git.kernel.org/stable/c/0ba68bea1e356f466ad29449938bea12f5f3711f
- https://git.kernel.org/stable/c/74837bca0748763a77f77db47a0bdbe63b347628
- https://git.kernel.org/stable/c/8fcc7315a10a84264e55bb65ede10f0af20a983f
- https://git.kernel.org/stable/c/9c328f54741bd5465ca1dc717c84c04242fac2e1
- https://git.kernel.org/stable/c/bfdda0123dde406dbff62e7e9136037e97998a15
- https://git.kernel.org/stable/c/c395d1e548cc68e84584ffa2e3ca9796a78bf7b9