PT-2026-37408 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-26 · CVE-2026-43098

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NFC s3fwrn5 component where the s3fwrn82 uart read() function reports accepted bytes to the serdev core. The system may deliver a complete frame before allocating a new receive buffer. If alloc skb() fails, the callback returns 0 despite having consumed bytes, leaving recv skb as NULL. This violates the receive buf() accounting contract and can lead to a NULL pointer dereference—a condition where the software attempts to read from a memory address that is null—during the subsequent skb put u8() call.

Recommendations Allocate the receive skb lazily before consuming the next byte; if allocation fails, return the number of bytes already accepted.

Fix

Related Identifiers

CVE-2026-43098

Affected Products

Linux Kernel

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43098 · Vendor Advisory
• https://git.kernel.org/stable/c/d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-43098 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43098 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43098 · Vendor Advisory
• https://git.kernel.org/stable/c/6d931680a9851481c3243689488eafed08eeff71 · Patch
• https://git.kernel.org/stable/c/5c14a19d5b1645cce1cb1252833d70b23635b632 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43098 · Vendor Advisory
• https://git.kernel.org/stable/c/09822d3d6f68a0cdc4626e0c507324a4927f55a9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43098 · Security Note
• https://ubuntu.com/security/CVE-2026-43098 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43098 · Security Note
• https://git.kernel.org/stable/c/7c31f7a599cf00fad3c204092a91a924126c67e4 · Patch
• https://docs.bell-sw.com/security/cves/CVE-2026-43098 · Note
• https://git.kernel.org/stable/c/e4ab0fd1c91882f2a7846b1817781c8741f7f315 · Note