Executive brief
A vulnerability in the Linux kernel's NFC driver for Samsung S3FWRN5 chips could allow a local user to crash the system. The issue occurs when the system runs out of memory while processing data from an NFC device, leading to a system failure (NULL pointer dereference). This primarily impacts the availability of devices using this specific NFC hardware.
Technical details
A vulnerability exists in the s3fwrn82_uart_read() function within the s3fwrn5 NFC driver. The driver previously consumed bytes into a receive buffer (recv_skb) and attempted to allocate a new buffer only after a frame was complete. If alloc_skb() failed due to memory pressure, the driver would return 0 despite having consumed bytes and leave the internal buffer pointer as NULL. Subsequent calls to skb_put_u8() would then trigger a NULL pointer dereference. The fix implements lazy allocation of the socket buffer before byte consumption and ensures correct byte accounting upon allocation failure.
Affected products
- Linux Linux Kernel 5.11 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-02: other: Patch submitted by developer
- 2026-05-06: disclosed: CVE published
- 2026-05-06: advisory
References
- https://git.kernel.org/stable/c/09822d3d6f68a0cdc4626e0c507324a4927f55a9
- https://git.kernel.org/stable/c/20a57de2e79b797ed75382659d52bf4c7d9cb446
- https://git.kernel.org/stable/c/5c14a19d5b1645cce1cb1252833d70b23635b632
- https://git.kernel.org/stable/c/6d931680a9851481c3243689488eafed08eeff71
- https://git.kernel.org/stable/c/7c31f7a599cf00fad3c204092a91a924126c67e4
- https://git.kernel.org/stable/c/d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156
- https://git.kernel.org/stable/c/e4ab0fd1c91882f2a7846b1817781c8741f7f315