CVE-2026-43032: Linux Kernel NFC pn533 DoS Vulnerability

CVE-2026-43032 Overview

CVE-2026-43032 is a Linux kernel vulnerability in the NFC pn533 driver. The flaw affects the UART receive buffer handling in pn532_receive_buf(), where the function appends every incoming byte to dev->recv_skb without bounding the accumulation. The buffer only resets after pn532_uart_rx_is_frame() recognizes a complete PN532 frame.

A continuous stream of bytes lacking a valid PN532 frame header causes the socket buffer to grow until skb_put_u8() reaches the tail limit. The fix drops the accumulated partial frame once the fixed receive buffer is full, preventing the skb from exceeding PN532_UART_SKB_BUFF_LEN.

Critical Impact
Malformed UART traffic to a PN532 NFC device can trigger an out-of-bounds write condition in the kernel, leading to denial of service or potential memory corruption.

Affected Products

Linux kernel (NFC pn533 driver, UART transport)
Systems using PN532 NFC hardware over UART
Distributions shipping affected stable kernel branches prior to the patches referenced below

Discovery Timeline

2026-05-01 - CVE-2026-43032 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-43032

Vulnerability Analysis

The vulnerability resides in the pn533 NFC driver's UART receive path. The function pn532_receive_buf() is invoked by the tty layer whenever bytes arrive on the serial line connected to a PN532 NFC controller. Each incoming byte is appended to the driver's receive socket buffer (dev->recv_skb) using skb_put_u8().

The driver only clears the accumulated buffer after pn532_uart_rx_is_frame() confirms a fully formed PN532 protocol frame. When attacker-controlled or malformed UART input never produces a valid frame header, the buffer grows unbounded toward the skb tail limit PN532_UART_SKB_BUFF_LEN.

Reaching the tail limit triggers the kernel's skb overflow protections and can crash the system. The patched code now discards the partial frame once the fixed receive buffer is full, preventing the runaway append.

Root Cause

The root cause is missing input validation and absent bounds enforcement on the accumulated UART data. The driver assumed an upstream framing event would always reset the skb before it filled. Without a sentinel for malformed streams, the append loop could exhaust the fixed-size receive buffer.

Attack Vector

Exploitation requires the ability to deliver bytes to the UART line connected to a PN532 NFC controller. This generally implies physical proximity, a malicious peripheral, or local privileges sufficient to inject data into the serial transport. Remote network exploitation is not applicable to this driver path.

The vulnerability manifests when the driver continuously receives bytes that never satisfy the PN532 frame parser. See the kernel commit fix for the exact code change.

Detection Methods for CVE-2026-43032

Indicators of Compromise

Kernel warnings or oops messages referencing skb_put or skb_over_panic originating from the pn533 or pn532_uart modules.
Unexpected resets, hangs, or panics on systems with PN532 NFC hardware attached over UART.
Anomalous high-volume serial traffic to NFC tty devices not matching valid PN532 framing.

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for skb overflow stack traces tied to NFC modules.
Audit running kernel versions against the patched commits listed in the kernel.org references to identify unpatched hosts.
Track loaded modules with lsmod | grep pn533 to enumerate exposed systems requiring patching.

Monitoring Recommendations

Alert on unexpected loading of the pn533 and pn533_uart modules on systems that should not use NFC.
Correlate kernel crash telemetry with serial subsystem activity to identify exploitation attempts.
Track firmware and kernel package update status across the fleet to verify patch deployment coverage.

How to Mitigate CVE-2026-43032

Immediate Actions Required

Apply the upstream Linux kernel patches referenced on kernel.org for the pn533 UART driver to all affected stable branches.
Update to a distribution kernel that includes the fix and reboot affected hosts to load the patched module.
Where NFC over UART is not required, blacklist the pn533 and pn533_uart modules to remove the attack surface.

Patch Information

The fix is committed across multiple stable Linux kernel branches. Reference commits include 23e9251, 2c1fadd, 30fe3f5, 3adca9b, 8bedf1d, ad2f60d, cf2ff10, and f48ab6e. Pull the latest stable kernel for your branch from your distribution.

Workarounds

Unload and blacklist the pn533 and pn533_uart kernel modules on systems that do not require NFC functionality.
Restrict physical access to UART-attached NFC peripherals to prevent untrusted data injection.
Disable NFC hardware in BIOS or device tree on platforms where the feature is unused.

bash

# Blacklist the vulnerable NFC driver until patches are applied
echo 'blacklist pn533' | sudo tee /etc/modprobe.d/blacklist-pn533.conf
echo 'blacklist pn533_uart' | sudo tee -a /etc/modprobe.d/blacklist-pn533.conf
sudo rmmod pn533_uart pn533 2>/dev/null
sudo update-initramfs -u