CVE-2026-43291 net: nfc: nci: Fix parameter validation for packet data
A parameter validation error in the Linux kernel NFC driver causes access to uninitialized data, potentially leading to system crashes or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43291?
CVE-2026-43291 is a high-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: nfc: nci: Fix parameter validation for packet data
Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") communication with nci nfc chips is not working any more.
The mentioned commit tries to fix access of uninitialized data, but failed to understand that in some cases the data packet is of variable length and can therefore not be compared to the maximum packet length given by the sizeof(struct).
Weakness: CWE-908
Which versions are affected by CVE-2026-43291?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43291?
Apply the vendor's patch.
Is CVE-2026-43291 being exploited?
There is no known exploitation of CVE-2026-43291 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43291, DEBIAN-CVE-2026-43291, GHSA-r3q8-xm3r-6v78, ROOT-OS-UBUNTU-2204-CVE-2026-43291, ROOT-OS-UBUNTU-2404-CVE-2026-43291, UBUNTU-CVE-2026-43291.