Executive brief
The NFC pn533 driver in the Linux kernel had a race condition in its command sending path that could cause a buffer to be freed while still in use. When an I2C device receives a response while the driver is still sending a command, the response handler could free the send buffer prematurely, causing the transport layer to crash or potentially execute arbitrary code. This affects Linux systems using NFC pn533 devices.
Technical details
The vulnerability is a use-after-free race condition in the NFC pn533 driver (drivers/nfc/pn533/pn533.c). The root cause is that __pn533_send_async() publishes the command (sets dev->cmd) before calling the transport's send_frame() function. Once dev->cmd is set, an incoming I2C IRQ can trigger pn533_recv_frame(), which queues cmd_complete_work and pn533_send_async_complete() frees the request skb via consume_skb(). On I2C transports, pn533_i2c_send_frame() dereferences the skb after i2c_master_send() returns, creating a window where the skb can be freed before the transport finishes using it. The fix holds an extra reference (skb_get) across the send_frame() call via a new pn533_send_cmd_frame() helper, ensuring the skb remains valid even if command completion races the send. The patch was applied to upstream and stable kernel branches.
Affected products
- Linux kernel Multiple versions (fix applied to stable branches 4.19.y through 7.2.y and rolling branches)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched