Linux Kernel EUVD-2026-25553

The vulnerability resides in the Linux kernel's NFC subsystem, specifically the pn533 driver's serdev receive-buffer callback (pn532_receive_buf). The pn533 driver supports the NXP/Philips PN532 and PN533 NFC transceiver chips commonly connected over USB-serial or UART interfaces. The serdev (serial device) framework calls receive_buf() with incoming bytes and expects the callback to return the number of accepted bytes - a strict accounting contract. The bug arises from an incorrect resource allocation order: the existing code consumes bytes into recv_skb and may dispatch a complete frame to pn533_recv_frame() before allocating a fresh receive skb via alloc_skb(). If alloc_skb() fails (e.g., under memory pressure), the function returns 0 despite having already consumed bytes, and leaves recv_skb as NULL. The subsequent receive callback then dereferences this NULL pointer in skb_put_u8(), producing a kernel NULL dereference - a class of bug closely related to CWE-476 (NULL Pointer Dereference). The fix restructures the allocation to happen lazily before consuming each byte, so that allocation failure causes an early return of the already-accepted byte count rather than a broken NULL state. CPE cpe:2.3:a:linux:linux confirms the affected product is the upstream Linux kernel.