Medium 5.5Published May 6, 2026

CVE-2026-43098nfc: s3fwrn5: allocate rx skb before consuming bytes

Updated under an hour ago (Oct 27, 2026, 4:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nfc: s3fwrn5: allocate rx skb before consuming bytes s3fwrn82_uart_read() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already deliver a complete frame before allocating a fresh receive buffer. If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8(). Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 1, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3f52c2cb7e3ada37513dabb69a22cf917dba754f before 20a57de2e79b797ed75382659d52bf4c7d9cb446; from 3f52c2cb7e3ada37513dabb69a22cf917dba754f before e4ab0fd1c91882f2a7846b1817781c8741f7f315; from 3f52c2cb7e3ada37513dabb69a22cf917dba754f before d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156; from 3f52c2cb7e3ada37513dabb69a22cf917dba754f before 7c31f7a599cf00fad3c204092a91a924126c67e4; from 3f52c2cb7e3ada37513dabb69a22cf917dba754f before 6d931680a9851481c3243689488eafed08eeff71; from 3f52c2cb7e3ada37513dabb69a22cf917dba754f before 09822d3d6f68a0cdc4626e0c507324a4927f55a9; from 3f52c2cb7e3ada37513dabb69a22cf917dba754f before 5c14a19d5b1645cce1cb1252833d70b23635b632	CNA record
linux linux_kernel linux:linux_kernel	from 5.11 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 7.0; 7.0; 7.0; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/20a57de2e79b797ed75382659d52bf4c7d9cb446
https://git.kernel.org/stable/c/e4ab0fd1c91882f2a7846b1817781c8741f7f315
https://git.kernel.org/stable/c/d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156	patch
https://git.kernel.org/stable/c/7c31f7a599cf00fad3c204092a91a924126c67e4	patch
https://git.kernel.org/stable/c/6d931680a9851481c3243689488eafed08eeff71	patch
https://git.kernel.org/stable/c/09822d3d6f68a0cdc4626e0c507324a4927f55a9	patch
https://git.kernel.org/stable/c/5c14a19d5b1645cce1cb1252833d70b23635b632	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.