Junglewise Threat Intelligence

CVE-2026-43291: Linux kernel uninitialized memory access in NFC NCI driver

CVE-2026-43291 · Severity: high · CVSS 8.3 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Near Field Communication (NFC) subsystem could allow an attacker to access sensitive information or cause a system crash. The issue stems from how the system validates data packets sent from NFC chips, which can lead to the processing of uninitialized memory. This affects devices using NCI-based NFC hardware, potentially impacting data privacy and system stability.

Technical details

A vulnerability exists in the net/nfc/nci component of the Linux kernel due to improper parameter validation for packet data. A previous attempt to fix uninitialized data access (commit 9c328f54741b) incorrectly compared variable-length data packets against fixed-size structures using sizeof(). This logic error can be exploited by an attacker in close proximity (adjacent) to send malformed NCI packets that bypass length checks. This results in out-of-bounds reads or access to uninitialized kernel memory, potentially leading to information disclosure or a kernel oops. The fix involves implementing proper offset-based length validation for variable-length NCI notification packets.

Affected products

  • Linux Linux kernel All versions since commit 9c328f54741b

Timeline

  • 2026-02-18: other: Patch submitted by Michael Thalmeier
  • 2026-05-08: disclosed: CVE published

References

Related threats