Skip to main content

Linux Kernel CVE-2026-43032

| EUVDEUVD-2026-26631 MEDIUM
2026-05-01 Linux
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
May 08, 2026 - 21:00 vuln.today
CVSS changed
May 08, 2026 - 18:52 NVD
5.5 (MEDIUM)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26631
CVE Published
May 01, 2026 - 14:15 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFC: pn533: bound the UART receive buffer

pn532_receive_buf() appends every incoming byte to dev->recv_skb and only resets the buffer after pn532_uart_rx_is_frame() recognizes a complete frame. A continuous stream of bytes without a valid PN532 frame header therefore keeps growing the skb until skb_put_u8() hits the tail limit.

Drop the accumulated partial frame once the fixed receive buffer is full so malformed UART traffic cannot grow the skb past PN532_UART_SKB_BUFF_LEN.

AnalysisAI

Denial of service in the Linux kernel NFC PN533 UART driver allows local authenticated attackers to exhaust memory by sending malformed NFC frames without valid headers, causing unbounded socket buffer growth until kernel crash. Affects Linux 5.5 through 7.0 with patches available across all maintained stable branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0); EPSS exploitation probability is minimal at 0.02%, but local privilege is required.

Technical ContextAI

The vulnerability exists in the NFC PN533 driver's UART receive function (pn532_receive_buf) within the Linux kernel's NFC subsystem. The driver accumulates incoming UART bytes into a socket buffer (dev->recv_skb) by calling skb_put_u8() for each byte received. The buffer is only reset after the pn532_uart_rx_is_frame() function validates that a complete PN532 frame has been received, identified by checking for valid frame headers. If an attacker sends a continuous stream of malformed UART data without valid PN532 frame delimiters, the socket buffer grows indefinitely because the frame validation never succeeds and the reset never triggers. The underlying issue is an unbounded memory allocation in the receive path when parsing UART-based NFC protocol traffic, lacking a hard cap on partial frame accumulation relative to the fixed PN532_UART_SKB_BUFF_LEN buffer limit.

RemediationAI

Apply vendor-released kernel patch. For stable branch users: update to Linux 5.10.253 (or later 5.10.x), 5.15.203 (or later 5.15.x), 6.1.168 (or later 6.1.x), 6.6.134 (or later 6.6.x), 6.12.81 (or later 6.12.x), 6.18.22 (or later 6.18.x), 6.19.12 (or later 6.19.x), or 7.0 and above. The fix adds a boundary check in pn532_receive_buf() to drop accumulated partial frames once the fixed receive buffer (PN532_UART_SKB_BUFF_LEN) is full. For systems where NFC functionality is not required, disable the NFC subsystem entirely at compile time (CONFIG_NFC=n) or unload the PN533 driver module (rmmod nfc_pn533_uart) to eliminate the attack surface. If NFC must remain enabled, restrict UART access to trusted users via file permissions on /dev/ttyUSB* or equivalent NFC device nodes to limit who can send malformed frames. Patches are available at git.kernel.org/stable/c/ with commit hashes referenced in CVEORG sources.

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43032 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy