In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an… (CVE-2025-40043)
In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized value bug in nci_init_req, which was introduced by commit 5aca7966d2a7 ("Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools"). This bug arises due to very limited and poor input validation that was done at nic_valid_size(). This validation only validates the skb->len (directly reflects size provided at the userspace interface) with the length provided in the buffer itself (interpreted as NCI_HEADER). This leads to the processing of memory content at the address assuming the correct layout per what opcode requires there. This leads to the accesses to buffer of `skb_buff->data` which is not assigned anything yet. Following the same silent drop of packets of invalid sizes at `nic_valid_size()`, add validation of the data in the respective handlers and return error values in case of failure. Release the skb if error values are returned from handlers in `nci_nft_packet` and effectively do a silent drop Possible TODO: because we silently drop the packets, the call to `nci_request` will be waiting for completion of request and will face timeouts. These timeouts can get excessively logged in the dmesg. A proper handling of them may require to export `nci_request_cancel` (or propagate error handling from the nft packets handlers).
AI Analysis
Technical Summary
The Linux kernel NFC NCI component had a vulnerability due to poor input validation in the nic_valid_size() function, which only checked skb->len against the buffer length interpreted as an NCI header. This allowed processing of uninitialized memory in skb_buff->data, as the data was not properly assigned before access. The vulnerability was reported by Syzbot and introduced by a specific commit. The remediation added validation in packet handlers to return errors and silently drop invalid packets, preventing memory misuse. However, this silent drop may cause timeouts and excessive logging, with potential future improvements suggested for error handling.
Potential Impact
The vulnerability allows processing of uninitialized memory within the kernel NFC NCI subsystem, which can lead to high impact on confidentiality, integrity, and availability of the system. Exploitation could cause kernel memory disclosure, corruption, or denial of service. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented that adds parameter validation for packet data and silently drops invalid packets to prevent processing of uninitialized memory. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an… (CVE-2025-40043)
Description
In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized value bug in nci_init_req, which was introduced by commit 5aca7966d2a7 ("Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools"). This bug arises due to very limited and poor input validation that was done at nic_valid_size(). This validation only validates the skb->len (directly reflects size provided at the userspace interface) with the length provided in the buffer itself (interpreted as NCI_HEADER). This leads to the processing of memory content at the address assuming the correct layout per what opcode requires there. This leads to the accesses to buffer of `skb_buff->data` which is not assigned anything yet. Following the same silent drop of packets of invalid sizes at `nic_valid_size()`, add validation of the data in the respective handlers and return error values in case of failure. Release the skb if error values are returned from handlers in `nci_nft_packet` and effectively do a silent drop Possible TODO: because we silently drop the packets, the call to `nci_request` will be waiting for completion of request and will face timeouts. These timeouts can get excessively logged in the dmesg. A proper handling of them may require to export `nci_request_cancel` (or propagate error handling from the nft packets handlers).
CVSS v3.1
Score 8.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel NFC NCI component had a vulnerability due to poor input validation in the nic_valid_size() function, which only checked skb->len against the buffer length interpreted as an NCI header. This allowed processing of uninitialized memory in skb_buff->data, as the data was not properly assigned before access. The vulnerability was reported by Syzbot and introduced by a specific commit. The remediation added validation in packet handlers to return errors and silently drop invalid packets, preventing memory misuse. However, this silent drop may cause timeouts and excessive logging, with potential future improvements suggested for error handling.
Potential Impact
The vulnerability allows processing of uninitialized memory within the kernel NFC NCI subsystem, which can lead to high impact on confidentiality, integrity, and availability of the system. Exploitation could cause kernel memory disclosure, corruption, or denial of service. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented that adds parameter validation for packet data and silently drops invalid packets to prevent processing of uninitialized memory. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rwhf-69pj-m4jv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40043"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d79c2644c7f847b4f5
Added to database: 07/30/2026, 15:50:47 UTC
Last enriched: 07/30/2026, 16:10:03 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.