Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-80797

CVE-2026-80797: Linux Kernel NFC Information Disclosure

CVE-2026-80797 is an information disclosure vulnerability in the Linux kernel NFC subsystem that causes memory leaks through improper fragment cleanup. This article covers the technical details, affected versions, impact analysis, and mitigation strategies.

Published:

CVE-2026-80797 Overview

CVE-2026-80797 is a memory leak vulnerability in the Linux kernel's Near Field Communication (NFC) subsystem, specifically in the pn533 driver for PN533-based NFC controllers. The pn53x_common_clean() function purges the response queue (resp_q) before freeing the common PN533 state but does not release skbs held in fragment_skb. When the device is removed while transmit fragments remain queued, the driver frees the PN533 state without releasing those buffers, leaking kernel memory. The fix purges fragment_skb alongside resp_q during cleanup.

Critical Impact

Kernel memory leak triggered by device removal while fragmented NFC frames are queued, contributing to resource exhaustion on affected systems.

Affected Products

  • Linux kernel versions containing the nfc/pn533 driver prior to the referenced stable commits
  • Systems using PN533-based NFC USB or UART hardware
  • Distributions shipping affected mainline and long-term stable kernel branches

Discovery Timeline

  • 2026-09-04 - CVE-2026-80797 published to NVD
  • 2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80797

Vulnerability Analysis

The pn533 driver supports NFC controllers that require fragmentation when transmitting large initiator or target-mode frames. Fragmentation helpers enqueue transmit fragments on fragment_skb, and those socket buffers remain owned by the driver until they are sent or explicitly discarded.

During teardown, pn53x_common_clean() calls skb_queue_purge() on resp_q before releasing the common state. It does not perform the same operation on fragment_skb. Any skbs still queued on fragment_skb at teardown are orphaned when the surrounding state is freed, producing a kernel memory leak.

The issue is confined to the cleanup path and does not directly expose memory corruption or code execution. Repeated device removal under load can accumulate leaked buffers and reduce available kernel memory over time.

Root Cause

The root cause is incomplete resource release in pn53x_common_clean(). The cleanup function accounts for resp_q but omits fragment_skb, which the fragmentation helpers populate during large-frame transmission. Without a matching purge, queued skbs are not returned to the kernel allocator when the driver state is freed.

Attack Vector

Triggering the leak requires the presence of a PN533 NFC device and a workload that produces queued fragments, followed by device removal (physical unplug or driver unbind). A local attacker with the ability to load, unload, or rebind the driver, or with physical access to attach and detach USB NFC hardware, can force the condition. The vulnerability does not enable remote exploitation and does not yield privilege escalation on its own.

See the upstream patch at Kernel Git Commit #130b5ad for the corrective change.

Detection Methods for CVE-2026-80797

Indicators of Compromise

  • Growth in kernel slab consumption for skbuff_head_cache entries correlated with NFC device unbind or hot-unplug events.
  • Repeated bind/unbind cycles of the pn533_usb or pn533 driver on hosts where NFC is not required.
  • Presence of unpatched kernel versions on systems exposing PN533-class NFC controllers.

Detection Strategies

  • Inventory running kernel versions against the fixed commits referenced in the vendor advisory to identify vulnerable hosts.
  • Monitor /proc/slabinfo and kernel memory metrics for sustained growth without corresponding workload increase.
  • Alert on unexpected loading of pn533, pn533_usb, or pn533_i2c modules on servers and workstations that do not require NFC.

Monitoring Recommendations

  • Collect kernel logs (dmesg) and audit USB device attach/detach events for NFC hardware.
  • Track module load and unload events with auditd rules targeting the pn533 family of drivers.
  • Correlate device removal events with memory-pressure alerts to identify leak-induced degradation.

How to Mitigate CVE-2026-80797

Immediate Actions Required

  • Apply the upstream fix that adds skb_queue_purge(&dev->fragment_skb) to pn53x_common_clean(), available in the referenced stable commits.
  • Update to a distribution kernel that includes the backported patch for your supported release branch.
  • Blacklist the pn533 and pn533_usb modules on systems that do not use NFC hardware.

Patch Information

The upstream fix is available in multiple stable branches. See the kernel commits: 130b5ad, 2f5d093, 4a52ec2, 5718fc6, 9319c3c, d63e85c, e169277, e7ed2ea, and e95beff. Rebuild and reboot after applying the patched kernel package.

Workarounds

  • Prevent unprivileged users from loading or unloading the pn533 driver by restricting CAP_SYS_MODULE and using modprobe.d blacklist entries.
  • Disable USB NFC device attachment on systems that do not require it using USBGuard or platform-level USB policy.
  • Reboot systems that have accumulated leaked buffers if patching cannot be scheduled immediately.
bash
# Configuration example: blacklist pn533 modules until a patched kernel is deployed
echo "blacklist pn533" | sudo tee /etc/modprobe.d/blacklist-pn533.conf
echo "blacklist pn533_usb" | sudo tee -a /etc/modprobe.d/blacklist-pn533.conf
echo "blacklist pn533_i2c" | sudo tee -a /etc/modprobe.d/blacklist-pn533.conf
sudo update-initramfs -u

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne