CVE-2026-43098: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43098 Overview

CVE-2026-43098 is a Linux kernel vulnerability in the Near Field Communication (NFC) s3fwrn5 driver. The flaw resides in the s3fwrn82_uart_read() function used by the serdev (serial device) bus to deliver UART bytes to the driver. The function consumes incoming bytes into a receive socket buffer (recv_skb) before allocating a fresh buffer for the next frame. When alloc_skb() fails, the callback returns 0 despite having already consumed bytes and leaves recv_skb as NULL. This breaks the receive_buf() accounting contract and can trigger a NULL pointer dereference on the next skb_put_u8() call.

Critical Impact
A failed memory allocation in the NFC UART receive path can leave the driver in an inconsistent state, producing a kernel NULL pointer dereference on the next inbound byte.

Affected Products

Linux kernel (mainline) versions containing the s3fwrn5 NFC driver
Linux stable branches addressed by the upstream fix commits
Distributions shipping kernels with the nfc/s3fwrn5 UART transport enabled

Discovery Timeline

2026-05-06 - CVE-2026-43098 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43098

Vulnerability Analysis

The s3fwrn5 driver implements the serdev receive_buf callback through s3fwrn82_uart_read(). The serdev core requires the callback to return the exact number of bytes consumed from the inbound UART stream so the unprocessed remainder can be presented again. The vulnerable implementation consumed bytes into the existing recv_skb, potentially completed and dispatched a full NCI frame, and only then allocated a new recv_skb for the next frame.

If the post-dispatch alloc_skb() returns NULL, the function exits without allocating a replacement buffer, returns 0, and leaves recv_skb in a NULL state. On the next inbound byte, the driver calls skb_put_u8() against a NULL sk_buff, dereferencing a NULL pointer in kernel context. The mismatched return value also corrupts the serdev byte accounting, causing already-consumed bytes to be replayed.

Root Cause

The root cause is improper ordering of buffer allocation and byte consumption combined with missing handling for allocation failure [CWE-476]. The driver assumed alloc_skb() would succeed and used it as a post-frame replenishment step rather than a precondition for accepting a byte. The fix changes allocation to lazy, on-demand behavior: the driver allocates recv_skb only when it is about to consume the next byte. When allocation fails, the callback returns the number of bytes already accepted, preserving the serdev contract and avoiding the dangling NULL state.

Attack Vector

Triggering the flaw requires the s3fwrn5 UART transport to be loaded and processing NFC traffic while the kernel is under sufficient memory pressure to fail an alloc_skb() in atomic or GFP_KERNEL context. The condition is most reachable on embedded and mobile Linux platforms that wire the Samsung S3FWRN82 NFC controller over UART. Successful triggering yields a kernel NULL pointer dereference resulting in denial of service.

No verified public proof-of-concept code is available. Refer to the upstream kernel commits for technical details: Kernel Git Commit 6d93168 and Kernel Git Commit 7c31f7a.

Detection Methods for CVE-2026-43098

Indicators of Compromise

Kernel oops or panic logs referencing s3fwrn82_uart_read, skb_put_u8, or NULL pointer dereference within the nfc/s3fwrn5 module.
dmesg entries showing repeated serdev receive_buf accounting warnings or stalled NFC transactions on devices using the S3FWRN82 controller.
Unexpected device resets or NFC service crashes on systems where the s3fwrn5_nci module is loaded.

Detection Strategies

Inventory running kernels and compare against the patched stable releases referenced in the upstream commits.
Monitor kernel ring buffer telemetry for stack traces involving s3fwrn5 symbols and correlate with NFC subsystem activity.
Audit loaded modules with lsmod | grep s3fwrn5 on fleet endpoints to identify systems exposed to the vulnerable code path.

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized logging platform and alert on BUG: or Oops: entries citing NFC driver symbols.
Track memory pressure metrics on embedded Linux devices, since allocation failures are the trigger condition for this flaw.
Apply EDR file-integrity monitoring to /lib/modules/$(uname -r)/kernel/drivers/nfc/s3fwrn5/ to detect tampering or unexpected module replacement.

How to Mitigate CVE-2026-43098

Immediate Actions Required

Upgrade to a Linux kernel build that includes the upstream fix referenced in the kernel.org stable commits.
On systems that do not require NFC functionality, blacklist the s3fwrn5_nci and s3fwrn5_uart modules to remove the vulnerable code path.
Validate vendor kernel images on mobile and embedded platforms to confirm backports of the patch have been applied.

Patch Information

The fix reorders allocation and consumption so that recv_skb is allocated lazily before the next byte is read. If alloc_skb() fails, the function returns the count of bytes already accepted, satisfying the receive_buf() contract and preventing the NULL state. The patch is available across stable branches via Kernel Git Commit 09822d3, Kernel Git Commit 5c14a19, Kernel Git Commit 6d93168, Kernel Git Commit 7c31f7a, and Kernel Git Commit d8c2aa3.

Workarounds

Disable NFC over UART by unloading the driver: modprobe -r s3fwrn5_uart s3fwrn5_nci.
Add a modprobe blacklist entry on systems that do not need the Samsung S3FWRN82 NFC controller.
Reduce memory pressure on affected devices to lower the probability of alloc_skb() failure until the patch is deployed.

bash

# Configuration example
echo 'blacklist s3fwrn5_uart' | sudo tee /etc/modprobe.d/blacklist-s3fwrn5.conf
echo 'blacklist s3fwrn5_nci'  | sudo tee -a /etc/modprobe.d/blacklist-s3fwrn5.conf
sudo modprobe -r s3fwrn5_uart s3fwrn5_nci
sudo update-initramfs -u