CVE-2025-40043

In the Linux kernel's NFC (Near Field Communication) subsystem, the nci_init_req function is vulnerable to a bug involving uninitialized data, as reported by syzbot. The root cause is the limited input validation performed by nci_valid_size(). This function only validates the socket buffer length (skb->len) against the length provided in the packet header itself, but fails to ensure that the payload data for specific opcodes is actually present and properly initialized. As a result, the kernel may access memory at skb->data that has not been assigned any content, leading to the processing of uninitialized values.

Exploitation

An attacker can trigger this vulnerability by sending a crafted NCI packet from userspace via the NFC Netlink interface. The exploit requires the ability to create a raw NFC socket and send data that passes the minimal length checks but contains an opcode requiring additional payload that is not supplied. No authentication is required beyond local access to the NFC device node (typically requiring CAP_NET_ADMIN or physical presence). The attack is performed locally and does not require any special network position.

Impact

A successful exploit can cause the kernel to process uninitialized memory, potentially leaking sensitive kernel heap data to an attacker. The leaked data may contain information useful for further exploitation, such as memory addresses or other secrets. The vulnerability does not directly lead to code execution, but information disclosure can weaken other kernel defenses.

Mitigation

The fix is included in the Linux kernel stable commit 9c328f54741bd and 74837bca0748 [1][2]. These patches add proper validation of packet data in the respective handlers and return error values on failure, releasing the socket buffer to ensure silent packet drops. Users should apply the updated kernel as soon as possible. No workaround is available, as the issue is in core NFC protocol handling.