Linux Kernel NFC NCI UART Driver Vulnerability Allows Local Privilege Escalation
A race condition in the Linux Kernel's NFC NCI UART driver enables local privilege escalation, requiring prior low-privileged code execution.
A critical vulnerability has been identified in the Linux Kernel's Near Field Communication (NFC) Network Controller Interface (NCI) UART driver, allowing local attackers to escalate their privileges. The issue, tracked as ZDI-26-685, was disclosed by the Zero Day Initiative (ZDI) and carries a CVSS score of 8.8, indicating a high severity.
Exploitation of this vulnerability requires an attacker to first gain the ability to execute low-privileged code on the target system. Once this initial foothold is established, the attacker can then leverage the race condition within the driver to elevate their privileges to that of the kernel.
The specific flaw lies in the way the driver handles nci_uart objects. The vulnerability arises from a lack of proper locking mechanisms when performing operations on these objects. This oversight can lead to a race condition where multiple threads or processes can access and modify the object concurrently in an uncontrolled manner, leading to unexpected behavior and potential security bypasses.
By exploiting this race condition, an attacker can manipulate the kernel's internal state, ultimately allowing them to escalate privileges and execute arbitrary code within the context of the kernel. This level of access would grant them complete control over the affected system, enabling them to install malware, steal sensitive data, or disrupt system operations.
Linux has released an update to address this vulnerability. The fix is detailed in a commit to the Linux kernel repository, specifically commit fc27ab48904ceb7e4792f0c400f1ef175edf16fe. Users are strongly advised to apply this patch as soon as possible to mitigate the risk.
The vulnerability was initially reported to the vendor on June 17, 2025. Following a coordinated disclosure process, the advisory was publicly released on September 14, 2026, with an update to the advisory on the same day. The research leading to the discovery of this flaw is credited to Maher Azzouzi.
This vulnerability underscores the ongoing challenges in securing complex operating system kernels. Even seemingly niche drivers like the NFC NCI UART driver can harbor critical flaws that, when combined with other vulnerabilities or misconfigurations, can lead to significant security breaches. Regular patching and vigilant monitoring remain crucial for maintaining system integrity.