CVE-2026-90222

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the NFC PN533 driver where the request skb (socket buffer) can be freed while the transport is still using it. This occurs because pn533 send async() publishes the command before calling dev->phy ops->send frame(). In the I2C transport, pn533 i2c send frame() dereferences the skb after i2c master send() returns. If a completion event races the send process, pn533 send async complete() may call consume skb() to free the request skb while it is still being accessed by the transport path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.