8.3

CVE-2026-43291

net: nfc: nci: Fix parameter validation for packet data

In the Linux kernel, the following vulnerability has been resolved:

net: nfc: nci: Fix parameter validation for packet data

Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for
packet data") communication with nci nfc chips is not working any more.

The mentioned commit tries to fix access of uninitialized data, but
failed to understand that in some cases the data packet is of variable
length and can therefore not be compared to the maximum packet length
given by the sizeof(struct).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.15.195 < 5.15.202
Linux ≫ Linux Kernel Version >= 6.1.156 < 6.1.165
Linux ≫ Linux Kernel Version >= 6.6.112 < 6.6.128
Linux ≫ Linux Kernel Version >= 6.12.53 < 6.12.75
Linux ≫ Linux Kernel Version >= 6.17.3 < 6.18
Linux ≫ Linux Kernel Version >= 6.18 < 6.18.16
Linux ≫ Linux Kernel Version >= 6.19 < 6.19.6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.182
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8.3 2.8 5.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

https://git.kernel.org/stable/c/a24a8a582da4426b2042e510a1080df84083b51d
Patch
https://git.kernel.org/stable/c/f5218426f765eee22e178df9c126d974792fb6a5
Patch
https://git.kernel.org/stable/c/ad058a4317db7fdb3f09caa6ed536d24a62ce6a0
Patch
https://git.kernel.org/stable/c/3b91160e9a91b5a2662875417dc42dc5b0bf03ea
Patch
https://git.kernel.org/stable/c/c692db813a7e3b7c3c17d6e9a3ad2a018bf1142b
Patch
https://git.kernel.org/stable/c/498fc5d0d650c77e87fcc73808d4f43240c21805
Patch
https://git.kernel.org/stable/c/571dcbeb8e635182bb825ae758399831805693c2
Patch