CVE-2026-43291

What it actually does

This Linux kernel flaw affects the NFC Controller Interface (NCI) packet-handling path in the NFC subsystem. The vulnerable logic performs incorrect parameter validation for variable-length packet data, treating some packets as if their length can be safely validated against a fixed-size structure. A malformed or unexpected NCI packet can therefore lead to improper memory access behavior, including exposure of uninitialized kernel data, partial corruption of protocol state, or denial of service in the NFC stack. The CVSS vector indicates exploitation requires adjacent access, no privileges, and no user interaction, with high confidentiality and availability impact.

Why it matters to the business

Systems with enabled NFC/NCI support may be exposed to data leakage or service disruption from a nearby attacker or malicious NFC-adjacent device. The most likely operational impact is instability of NFC functionality or kernel-level faults on affected endpoints, embedded devices, mobile-style Linux systems, kiosks, or IoT platforms using NFC. This issue is not listed in CISA KEV, has no known ransomware association, and has a low EPSS score, so broad internet-scale exploitation is unlikely; however, organizations that rely on NFC in exposed physical environments should prioritize remediation because exploitation does not require authentication or user interaction once the attacker is within NFC-adjacent range.

How an attack unfolds

An attacker positions a malicious NFC-capable device or controller within communication range of a Linux system using the vulnerable NFC NCI stack. The attacker sends crafted NCI packet data that exercises the variable-length packet parsing path. Because the vulnerable validation logic incorrectly compares packet data against fixed structure sizes, the kernel may process data that is shorter, longer, or shaped differently than expected. Depending on kernel build, memory layout, and driver behavior, this can expose uninitialized kernel memory, disrupt NFC protocol state, or trigger kernel errors that impair availability. There is currently no public exploit maturity reported, and the attack is constrained to adjacent-access scenarios rather than remote network exploitation.

How to fix it

Upgrade to a Linux kernel version that includes the upstream fix for NFC NCI packet data parameter validation. No exact fixed package versions were provided in the input, so use the patched kernel supplied by the relevant Linux distribution or vendor once available. Where immediate patching is not possible, reduce exposure by disabling NFC support if it is not required, unloading or blacklisting NFC/NCI-related kernel modules, disabling NFC hardware in firmware or device policy where supported, and restricting physical access to systems with NFC enabled. For embedded or appliance-style products, obtain a vendor firmware image that incorporates the corrected kernel NFC stack.

How to confirm the fix worked

Confirm the running kernel is a vendor build that includes the fix for the Linux NFC NCI packet validation issue. Validate exposure by checking whether NFC hardware is present and whether NFC/NCI kernel modules are loaded or built into the kernel. On systems where NFC is not required, verify that NFC functionality is disabled and modules cannot be loaded after reboot. Review package changelogs, vendor advisories, or kernel commit history for the NCI packet data validation fix. Functional validation should include NFC regression testing with legitimate NFC devices to confirm normal operation and negative testing with malformed or truncated NCI packets in a controlled lab to confirm the kernel rejects invalid packet data without leaking memory or crashing.

Typical attack path

1. Identify a target Linux system with NFC hardware and the kernel NFC/NCI subsystem enabled.
2. Move within NFC-adjacent range or use a malicious NFC/NCI-capable device capable of sending crafted packets.
3. Initiate NFC/NCI communication with malformed or unusual variable-length packet data.
4. Trigger the vulnerable packet validation path in the kernel NFC stack.
5. Cause disclosure of uninitialized kernel data, NFC subsystem malfunction, or kernel instability depending on the vulnerable kernel and driver behavior.
6. Optionally repeat malformed exchanges to cause recurring NFC service disruption or collect leaked data if observable through the attack channel.

How to detect it

To determine whether exploitation may already have occurred, review kernel logs, system journals, crash dumps, and endpoint telemetry for NFC/NCI-related errors, malformed packet handling, kernel oops events, KASAN reports, or unexpected NFC subsystem resets. Useful log sources include journalctl output, /var/log/kern.log, /var/log/messages, dmesg history, persistent pstore/ramoops data on embedded systems, crash dump repositories, and EDR telemetry that captures kernel faults or module activity. Investigate events involving nci_core or NFC drivers immediately preceding system instability, reboots, NFC malfunction, or unexplained disclosure-like behavior. Because exploitation requires adjacent access, correlate suspicious kernel events with physical-access indicators such as device proximity events, kiosk interactions, access-control logs, or maintenance windows. There are no known public threat actors or campaigns associated with this CVE in the provided data, so detection should focus on behavioral and kernel-level artifacts rather than actor-specific infrastructure.

• nci_core
• net/nfc/nci
• kernel: nci
• kernel: NFC
• BUG: KASAN
• KASAN:
• kernel BUG at net/nfc
• Oops:
• general protection fault
• Unable to handle kernel
• Call Trace:
• /var/log/kern.log
• /var/log/messages
• /sys/module/nci_core
• /proc/modules

What your security team should do

• Inventory Linux systems with NFC hardware or enabled NFC/NCI kernel support, prioritizing endpoints, kiosks, embedded devices, and physically accessible systems.
• Patch affected systems to a kernel version containing the NFC NCI packet validation fix as soon as vendor updates are available.
• Disable NFC/NCI support on systems that do not have a business requirement for NFC functionality.
• For systems that must keep NFC enabled, increase physical security controls and monitor for abnormal NFC-related kernel logs or crashes.
• Add detection content for kernel messages referencing NFC/NCI errors, KASAN findings, kernel oops events, or repeated NFC subsystem resets.
• Because the issue is not KEV-listed, has no ransomware association, and has low EPSS, prioritize based on NFC exposure and physical accessibility rather than treating it as an internet-facing emergency.
• For product teams shipping Linux-based devices with NFC, incorporate the fixed kernel into firmware images and perform NFC protocol robustness testing before release.