Linux Kernel EUVD-2026-27607

The s3fwrn5 NFC (Near Field Communication) driver handles UART serial device communication on Linux systems. The vulnerability resides in the s3fwrn82_uart_read() callback function, which is part of the serdev (serial device) framework that manages byte-oriented serial communication. The function receives data via the serial port and builds frames in a socket buffer (skb). The root cause is an incorrect order of operations: the current implementation consumes bytes from the receive stream and potentially delivers complete frames before allocating a new receive buffer (alloc_skb()). If this allocation fails, the callback violates the receive_buf() accounting contract by returning 0 (indicating no bytes consumed) even though bytes have already been consumed from the stream, and leaves recv_skb as NULL. Subsequent calls to skb_put_u8() on the NULL pointer cause a kernel crash. The fix reallocates the receive skb lazily before consuming the next byte, ensuring that if allocation fails, already-accepted bytes are properly reported and the buffer state remains consistent.