Cloudanix VulnDB

CVE-2026-80797

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in handling certain wireless card removal can waste system memory over time, which may eventually slow down or crash the computer.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The pn533 NFC driver fails to release queued fragment skbs during device cleanup in pn53x_common_clean(), causing a memory leak when the device is removed while transmit fragments remain pending.

Why it matters to the business

Systems using the affected driver may experience gradual memory exhaustion from repeated device removal events, leading to degraded performance or instability in environments handling NFC hardware.

How an attack unfolds

An attacker with local access triggers repeated connect/disconnect cycles on PN533 devices during large frame transmission to accumulate unreleased kernel memory buffers until resources are depleted.

How to fix it

Apply the upstream kernel patch that purges fragment_skb alongside resp_q in the common cleanup path, or upgrade to a Linux kernel release containing this fix.

How to confirm the fix worked

Confirm the fix by inspecting the pn53x_common_clean() function in kernel source for the added fragment_skb purge, or verify updated kernel packages include the referenced commit.

Typical attack path

  1. Locate a system exposing the pn533 driver
  2. Initiate transmission of large initiator or target-mode frames
  3. Force device removal while fragments remain queued
  4. Repeat the sequence to amplify the leak

How to detect it

Review kernel logs and dmesg output for pn533 activity around device removal events; correlate with system memory usage trends to identify potential leaks.

What your security team should do

  • Prioritize kernel updates for systems exposing the pn533 driver
  • Restrict physical or local access to NFC devices where feasible
  • Monitor memory metrics on affected hosts for anomalous growth

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented skbs during cleanup pn53x_common_clean() purges resp_q before freeing the common PN533 state, but it leaves fragment_skb untouched. The fragmentation helpers queue transmit fragments there while sending large initiator or target-mode frames, and those skbs remain owned by the driver until they are sent or discarded. If the device is removed while fragments are still queued, the common cleanup path frees the PN533 state without releasing the queued fragment skbs, leaking them. Purge fragment_skb during cleanup alongside resp_q.

Affected packages

Ecosystem Package Introduced Fixed