Medium 5.5Published Apr 24, 2026

CVE-2026-31660nfc: pn533: allocate rx skb before consuming bytes

Updated under an hour ago (Oct 28, 2026, 5:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: allocate rx skb before consuming bytes pn532_receive_buf() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already hand a complete frame to pn533_recv_frame() before allocating a fresh receive buffer. If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8(). Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c656aa4c27b17a8c70da223ed5ab42145800d6b5 before 2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb; from c656aa4c27b17a8c70da223ed5ab42145800d6b5 before 8b71299d587d9e4c830c18afb884c80ddb30ad28; from c656aa4c27b17a8c70da223ed5ab42145800d6b5 before 16649adc2e19509104245ea1f349b629d858f11f; from c656aa4c27b17a8c70da223ed5ab42145800d6b5 before 07cb6c72e66ba548679f22ac29ad588da8999279; from c656aa4c27b17a8c70da223ed5ab42145800d6b5 before a9495069b43b8634c1ae0042e888766c34f66637; from c656aa4c27b17a8c70da223ed5ab42145800d6b5 before 21ae2cda66a55c759607bbf1d23cbaa42019d2de; from c656aa4c27b17a8c70da223ed5ab42145800d6b5 before 7e37da42eda45d7859d9273fc7e225d8df458038; from c656aa4c27b17a8c70da223ed5ab42145800d6b5 before c71ba669b570c7b3f86ec875be222ea11dacb352	CNA record
linux linux_kernel linux:linux_kernel	from 5.5.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.169; from 6.2 before 6.6.135; from 6.7 before 6.12.82; from 6.13 before 6.18.23; from 6.19 before 6.19.13; 5.5; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb	patch
https://git.kernel.org/stable/c/8b71299d587d9e4c830c18afb884c80ddb30ad28	patch
https://git.kernel.org/stable/c/16649adc2e19509104245ea1f349b629d858f11f	patch
https://git.kernel.org/stable/c/07cb6c72e66ba548679f22ac29ad588da8999279	patch
https://git.kernel.org/stable/c/a9495069b43b8634c1ae0042e888766c34f66637	patch
https://git.kernel.org/stable/c/21ae2cda66a55c759607bbf1d23cbaa42019d2de	patch
https://git.kernel.org/stable/c/7e37da42eda45d7859d9273fc7e225d8df458038	patch
https://git.kernel.org/stable/c/c71ba669b570c7b3f86ec875be222ea11dacb352	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.