PT-2025-44111 · Linux+4 · Linux Kernel+4
Published
2025-09-25
·
Updated
2026-05-07
·
CVE-2025-40043
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a flaw related to insufficient input validation in the NFC (Near Field Communication) subsystem. Specifically, the
nci init req function had limited validation, leading to potential memory access issues when processing packet data. The issue stemmed from inadequate checks on the size and content of data received from the userspace interface, potentially allowing access to unassigned memory regions within the skb buff->data buffer. The vulnerability was introduced by commit 5aca7966d2a7. The fix involves adding data validation within the respective handlers and returning error values upon failure, along with releasing the skb if errors occur.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Access of Uninitialized Pointer
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu