CVE-2026-43291

net: nfc: nci: Fix parameter validation for packet data

State: Published
Severity: 8.3 High
Published: May 8, 2026
Updated: Aug 5, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: nfc: nci: Fix parameter validation for packet data

Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") communication with nci nfc chips is not working any more.

The mentioned commit tries to fix access of uninitialized data, but failed to understand that in some cases the data packet is of variable length and can therefore not be compared to the maximum packet length given by the sizeof(struct).

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8fcc7315a10a84264e55bb65ede10f0af20a983f to before a24a8a582da4426b2042e510a1080df84083b51dAffected bfdda0123dde406dbff62e7e9136037e97998a15 to before f5218426f765eee22e178df9c126d974792fb6a5Affected 0ba68bea1e356f466ad29449938bea12f5f3711f to before ad058a4317db7fdb3f09caa6ed536d24a62ce6a0Affected 74837bca0748763a77f77db47a0bdbe63b347628 to before 3b91160e9a91b5a2662875417dc42dc5b0bf03eaAffected 9c328f54741bd5465ca1dc717c84c04242fac2e1 to before c692db813a7e3b7c3c17d6e9a3ad2a018bf1142bAffected 9c328f54741bd5465ca1dc717c84c04242fac2e1 to before 498fc5d0d650c77e87fcc73808d4f43240c21805Affected 9c328f54741bd5465ca1dc717c84c04242fac2e1 to before 571dcbeb8e635182bb825ae758399831805693c2Affected c395d1e548cc68e84584ffa2e3ca9796a78bf7b9Affected 5.15.195 to before 5.15.202Affected 6.1.156 to before 6.1.165Affected 6.6.112 to before 6.6.128Affected 6.12.53 to before 6.12.75Affected 6.17.3 to before 6.18Affected
LinuxLinux	6.18Affected before 6.18Not affected 5.15.202 through 5.15.Not affected 6.1.165 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.16 through 6.18.Not affected 6.19.6 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

8fcc7315a10a84264e55bb65ede10f0af20a983f to before a24a8a582da4426b2042e510a1080df84083b51dAffected
bfdda0123dde406dbff62e7e9136037e97998a15 to before f5218426f765eee22e178df9c126d974792fb6a5Affected
0ba68bea1e356f466ad29449938bea12f5f3711f to before ad058a4317db7fdb3f09caa6ed536d24a62ce6a0Affected
74837bca0748763a77f77db47a0bdbe63b347628 to before 3b91160e9a91b5a2662875417dc42dc5b0bf03eaAffected
9c328f54741bd5465ca1dc717c84c04242fac2e1 to before c692db813a7e3b7c3c17d6e9a3ad2a018bf1142bAffected
9c328f54741bd5465ca1dc717c84c04242fac2e1 to before 498fc5d0d650c77e87fcc73808d4f43240c21805Affected
9c328f54741bd5465ca1dc717c84c04242fac2e1 to before 571dcbeb8e635182bb825ae758399831805693c2Affected
c395d1e548cc68e84584ffa2e3ca9796a78bf7b9Affected
5.15.195 to before 5.15.202Affected
6.1.156 to before 6.1.165Affected
6.6.112 to before 6.6.128Affected
6.12.53 to before 6.12.75Affected
6.17.3 to before 6.18Affected

LinuxLinux

6.18Affected
before 6.18Not affected
5.15.202 through 5.15.*Not affected
6.1.165 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.16 through 6.18.*Not affected
6.19.6 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.