VYPR
← All advisories
High severity7.1NVD Advisory· Published Jun 21, 2024· Updated May 12, 2026

CVE-2024-38381

CVE-2024-38381

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix uninit-value in nci_rx_work

syzbot reported the following uninit-value access issue [1]

nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, an uninitialized value in NFC nci_rx_work can be triggered by a malformed packet, potentially leading to information disclosure.

Vulnerability

CVE-2024-38381 is an uninit-value access vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem, specifically in the nci_rx_work function. The issue arises because the function fails to validate the header size, payload size, and total packet size of received packets from the ndev->rx_q queue. When an invalid packet is processed without proper validation, it can lead to the use of an uninitialized memory value, resulting in undefined behavior.

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted malformed packet to the NFC driver. The attack does not require authentication, as it can be triggered remotely if the NFC interface is exposed to an attacker-accessible network. The impact is local in terms of the CVSS attack vector, but the uninit-value read can potentially leak sensitive kernel memory contents.

Impact

Successful exploitation could result in information disclosure, as the uninitialized value may contain kernel memory data that could be read by an attacker. According to the referenced advisory [1], this vulnerability affects systems such as the SIMATIC S7-1500 TM MFP GNU/Linux subsystem. The CVSS v3 base score of 7.1 (High) reflects the potential for confidentiality impact.

Mitigation

The fix is to discard packets that fail the size validation checks silently, preventing the uninit-value access from occurring. Patches have been committed to the stable kernel tree, as referenced in [3] and [4]. Users should update their Linux kernel to a version containing the fix.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

183

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.