CVE-2026-43032

Vulnerability

The Linux kernel's NFC driver for PN533 devices, in the UART transport function pn532_receive_buf(), appends every incoming byte to a socket buffer (dev->recv_skb) without resetting until a complete PN532 frame is recognized by pn532_uart_rx_is_frame(). If an attacker sends a continuous stream of bytes that never forms a valid frame header, the skb grows unboundedly until skb_put_u8() hits the tail limit, causing a denial-of-service.[1]

Exploitation

Exploitation requires physical or logical access to send UART traffic to a system with the vulnerable driver. No authentication is needed beyond the ability to communicate over the UART bus (e.g., via a plugged-in NFC device or a compromised peripheral). The attack is purely data-driven: a malformed byte stream without valid PN532 frame headers is sufficient to trigger the unbounded growth.

Impact

An attacker can cause the kernel to exhaust the socket buffer's allocated tail space, leading to a system crash or hang. The highest threat is to availability; the vulnerability does not enable code execution or privilege escalation. The CVSS v3 score is 5.5 (Medium), reflecting the denial-of-service impact with a low attack complexity.

Mitigation

The fix is committed in the Linux stable kernel tree ([1], [2], [3], [4]). It enforces a limit check: once the partial accumulated frame reaches PN532_UART_SKB_BUFF_LEN, the buffer is dropped, preventing unbounded growth. System administrators should apply the corresponding stable kernel update as soon as possible.