CVE-2025-40043

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw related to insufficient input validation in the NFC (Near Field Communication) subsystem. Specifically, the nci init req function had limited validation, leading to potential memory access issues when processing packet data. The issue stemmed from inadequate checks on the size and content of data received from the userspace interface, potentially allowing access to unassigned memory regions within the skb buff->data buffer. The vulnerability was introduced by commit 5aca7966d2a7. The fix involves adding data validation within the respective handlers and returning error values upon failure, along with releasing the skb if errors occur.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.