CVE-2026-43291: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43291 Overview

CVE-2026-43291 affects the Near Field Communication Controller Interface (NCI) subsystem in the Linux kernel. The flaw resides in the net/nfc/nci packet data parameter validation logic. A prior fix introduced by commit 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") incorrectly compared variable-length NCI data packets against the fixed sizeof(struct) value. This broke communication with NCI NFC chips and created a path where uninitialized memory could be accessed [CWE-908]. The issue is tracked under the Linux kernel stable tree across multiple branches.

Critical Impact
An adjacent attacker within NFC radio range can trigger use of uninitialized memory in the kernel NCI handler, leading to information disclosure or denial of service on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Distributions shipping the upstream net/nfc/nci subsystem
Embedded and mobile Linux devices using NCI-compatible NFC controllers

Discovery Timeline

2026-05-08 - CVE-2026-43291 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-43291

Vulnerability Analysis

The vulnerability is classified as Use of Uninitialized Resource [CWE-908]. The NCI subsystem implements the NFC Forum NCI protocol used to communicate with NFC controllers over various transports. Packet data structures defined in net/nfc/nci represent multiple message types whose payload length is determined by the on-wire header, not by a static C structure size.

The upstream commit 9c328f54741b attempted to harden the parser by rejecting packets shorter than the destination structure. That length comparison treats sizeof(struct) as the minimum valid length. For NCI message types where the payload is intentionally shorter than the maximum structure, valid packets were rejected outright, breaking NFC communication, while edge cases still allowed undersized data to be copied into fields that the consumer later reads as if fully initialized.

Root Cause

The root cause is incorrect length validation in the NCI receive path. The original patch assumed all NCI packets map to a single fixed-size structure. NCI messages have variable-length payloads governed by the NCI specification. Comparing the received skb length against sizeof(struct nci_*) is therefore semantically wrong. The corrective patches introduce per-message-type length checks aligned with the NCI protocol header.

Attack Vector

Exploitation requires adjacent network access — proximity to an NFC-enabled Linux host or the ability to inject crafted NCI frames over the NFC transport. No authentication or user interaction is required. An attacker crafts an NCI packet whose declared length differs from the kernel's structural assumptions, causing the kernel to operate on partially initialized memory in the NCI control path. Successful exploitation can disclose kernel memory contents to userspace consumers or trigger kernel panics resulting in denial of service.

No verified public proof-of-concept code is currently available. Technical details are documented in the upstream stable commits referenced in the Linux kernel git repository.

Detection Methods for CVE-2026-43291

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nci_, nfc_nci, or net/nfc/nci in dmesg or /var/log/kern.log.
NFC service crashes, repeated NCI controller resets, or loss of communication with NFC chips on affected kernels.
KASAN reports indicating use of uninitialized memory in the NFC NCI receive path.

Detection Strategies

Inventory Linux hosts and identify kernel versions matching the vulnerable range using the stable commit references such as 3b91160e, 498fc5d0, 571dcbeb, a24a8a58, ad058a43, c692db81, and f5218426.
Verify whether the nfc and nci kernel modules are loaded with lsmod | grep -E 'nfc|nci' and assess exposure on devices where NFC is not required.
Enable kernel auditing for module loads and unexpected kernel warnings related to the NFC subsystem.

Monitoring Recommendations

Forward kernel logs to a central log analytics platform and alert on stack traces containing NFC NCI function symbols.
Monitor for sudden process terminations of neard or other NFC daemons that indicate underlying kernel instability.
Track patch deployment status across fleet endpoints, prioritizing mobile, point-of-sale, and IoT devices with active NFC radios.

How to Mitigate CVE-2026-43291

Immediate Actions Required

Apply the upstream stable kernel fixes referenced by commits 3b91160e, 498fc5d0, 571dcbeb, a24a8a58, ad058a43, c692db81, and f5218426 via your distribution's security updates.
On systems where NFC functionality is not used, blacklist the nfc and related nci modules to remove the attack surface entirely.
Restrict physical proximity access to deployed devices that expose active NFC radios in untrusted environments.

Patch Information

The Linux kernel maintainers issued corrected length-validation patches across multiple stable branches. The fixes replace the incorrect sizeof(struct) comparison with NCI-message-type-aware length checks. Patch commits are published in the kernel stable tree, including commit 3b91160e, commit 571dcbeb, and commit f5218426. Consult your distribution vendor for backported package versions.

Workarounds

Disable the NFC radio at the hardware or firmware level on devices where it is not required for business operations.
Prevent loading of vulnerable modules with echo 'blacklist nfc' > /etc/modprobe.d/disable-nfc.conf followed by update-initramfs -u.
Reduce exposure by ensuring affected endpoints are not left in physically accessible locations where adjacent-range NFC injection is feasible.

bash

# Configuration example: disable NFC NCI modules on systems that do not require NFC
sudo tee /etc/modprobe.d/disable-nfc.conf <<EOF
blacklist nfc
blacklist nci
blacklist nci_core
EOF

sudo modprobe -r nci nfc 2>/dev/null
sudo update-initramfs -u