CVE-2026-31660

Vulnerability

Overview

CVE-2026-31660 is a flaw in the Linux kernel's NFC driver for the PN533 chipset. In the pn532_receive_buf() function, the driver reads incoming serial data into a receive socket buffer (recv_skb). When a complete frame is assembled, the callback hands it off to pn533_recv_frame() and then attempts to allocate a new socket buffer for subsequent data. If the alloc_skb() call fails (e.g., due to memory pressure), the function returns 0, indicating that no bytes were consumed. However, the bytes that were already processed into the handed-off frame are irrevocably consumed from the serial device's viewpoint, breaking the accounting contract with the serdev subsystem. Furthermore, recv_skb is set to NULL after the failed allocation, so the next call to skb_put_u8() causes a NULL-pointer dereference [1][2][3][4].

Exploitation

Prerequisites and Attack Surface

Exploitation requires an attacker to be able to affect memory allocation on a system running a vulnerable kernel while it communicates with a PN533-based NFC controller. This may be achieved by exhausting kernel memory through other means (e.g., local denial-of-service or specific workload conditions). No authentication is needed to trigger the vulnerable code path; any data received from the NFC device can reach the buggy function. Physical proximity or logical access to the NFC interface is required, but the attack vector is considered local because the driver runs in kernel space [1][2][3][4].

Impact

A successful trigger of the allocation failure leads to a NULL-pointer dereference, causing a kernel oops and likely a system crash (denial of service). In some configurations, this could potentially be used to escalate privileges if the dereference is exploitable further, though the primary documented impact is system instability due to the NULL-pointer fault. The vulnerability is rated medium severity (CVSS 5.5) because it requires local access and specific conditions [1][2][3][4].

Mitigation

Patches have been issued for the Linux kernel. The fix, applied to multiple stable branches, changes the allocation to be lazy: the new recv_skb is allocated before consuming the next byte, and if allocation fails, the function returns the number of bytes already accepted, preserving accounting integrity and avoiding a NULL pointer [1][2][3][4]. Users should update their kernel to the latest stable version containing the commit.