CVE-2025-21735: Linux Kernel NFC Buffer Overflow Vulnerability

CVE-2025-21735 Overview

CVE-2025-21735 is an out-of-bounds write vulnerability [CWE-787] in the Linux kernel's Near Field Communication (NFC) NFC Controller Interface (NCI) subsystem. The flaw resides in the nci_hci_create_pipe() function, where the pipe variable is a u8 value received from the network without proper bounds checking. When the value exceeds 127, memory corruption occurs in the calling function nci_hci_connect_gate(). A local attacker with low privileges can trigger the flaw to compromise kernel memory integrity.

Critical Impact
Successful exploitation can result in kernel memory corruption leading to local privilege escalation, information disclosure, or system denial of service on affected Linux distributions.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Debian LTS distributions shipping vulnerable kernel versions
Siemens industrial products bundling affected kernels (see Siemens SSA-265688)

Discovery Timeline

2025-02-27 - CVE-2025-21735 published to the National Vulnerability Database (NVD)
2025-03 - Debian LTS security announcement issued for affected packages
2025-05 - Additional Debian LTS security announcement issued
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-21735

Vulnerability Analysis

The vulnerability affects the NFC NCI Host Controller Interface (HCI) implementation in the Linux kernel networking stack. The nci_hci_create_pipe() function accepts a pipe identifier derived from network-supplied data and returns it to nci_hci_connect_gate(). Because the returned value is used as an index into a fixed-size array without validation, a value larger than the array bound writes beyond allocated memory.

The patch resolves the flaw by adding a bounds check that rejects pipe values greater than NCI_HCI_MAX_PIPES (127) before the caller uses the identifier as an array index. Multiple stable kernel branches received backported fixes, referenced by commits including d5a461c315e5, 110b43ef0534, 172cdfc3a5ea, 2ae4bade5a64, and 59c7ed20217c.

Root Cause

The root cause is missing input validation on a u8 value sourced from an NFC packet. The function trusted the network-supplied pipe identifier and propagated it to the caller, which used it directly as an array index. Without bounds enforcement, indices between 128 and 255 caused writes past the end of the destination structure, corrupting adjacent kernel memory.

Attack Vector

Exploitation requires local access with low privileges on a system that processes NFC NCI traffic. An attacker crafts an NFC HCI message containing a pipe field greater than 127 and delivers it to the vulnerable NCI stack. When nci_hci_connect_gate() uses the unchecked value, the resulting out-of-bounds write corrupts kernel data structures. Skilled attackers can shape adjacent memory to achieve privilege escalation or arbitrary kernel code execution.

No public proof-of-concept exploit code is available at time of writing. See the kernel commit d5a461c315e5 for the authoritative patch details.

Detection Methods for CVE-2025-21735

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nci_hci_create_pipe or nci_hci_connect_gate in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds writes in the NFC NCI subsystem
Anomalous loading of the nfc or nci kernel modules on systems that do not use NFC hardware
Unexpected local privilege escalations correlated with NFC daemon activity

Detection Strategies

Audit installed kernel versions against the fixed commits listed in the vendor advisories to identify unpatched hosts
Monitor kernel ring buffer output for crashes or warnings originating in net/nfc/nci/hci.c
Deploy behavioral endpoint monitoring to flag processes attempting to load NFC-related modules or open /dev/nfc* devices on non-NFC systems
Correlate local privilege escalation alerts with prior NFC subsystem activity through a centralized data lake

Monitoring Recommendations

Enable kernel auditing (auditd) rules for init_module and finit_module syscalls to track kernel module loads
Forward kernel logs to a centralized log platform for retention and cross-host correlation
Track vendor patch bulletins from Debian and Siemens to align monitoring with disclosed patch windows
Alert on new local user sessions that immediately interact with NFC device nodes

How to Mitigate CVE-2025-21735

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution that include the upstream fix commits
Inventory systems that expose the NFC NCI subsystem and prioritize patching for multi-user or shared hosts
On systems that do not require NFC, blacklist the nfc and nci kernel modules to remove the attack surface
Restrict local access on affected hosts, as exploitation requires an authenticated local attacker

Patch Information

The upstream fix adds explicit bounds checking in nci_hci_create_pipe(). Fixes have been backported across multiple stable branches. Reference the following kernel commits for the authoritative patches: d5a461c315e5, 110b43ef0534, 172cdfc3a5ea, 2ae4bade5a64, and 59c7ed20217c. Debian users should apply updates from the March 2025 Debian LTS advisory and the May 2025 Debian LTS advisory. Siemens customers should follow the guidance in Siemens Security Advisory SSA-265688.

Workarounds

Disable NFC functionality where it is not needed by blacklisting the nfc and nci modules in /etc/modprobe.d/
Enforce least-privilege access controls to prevent untrusted local users from interacting with NFC device interfaces
Enable kernel hardening features such as KASLR, SMEP, and SMAP to raise the cost of memory corruption exploitation

bash

# Blacklist NFC kernel modules on hosts that do not require NFC
echo "blacklist nfc" | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo "blacklist nci" | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
sudo update-initramfs -u
sudo reboot