Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-43032— NFC: pn533: bound the UART receive buffer

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于NFC pn533驱动中UART接收缓冲区未绑定，导致恶意畸形UART流量可使skb无限增长直至达到尾部限制。

AI Predicted 5.5 Difficulty: Hard EPSS 0.16% · P5

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux c656aa4c27b17a8c70da223ed5ab42145800d6b5< 8bedf1dd5640ac8997bff00bbefe241b438df397 affected
c656aa4c27b17a8c70da223ed5ab42145800d6b5< 23e925183db26cd322597679669ad29d70ed2ada affected
c656aa4c27b17a8c70da223ed5ab42145800d6b5< 3adca9be14bf36b927193f05f5aea35a1a90e913 affected
c656aa4c27b17a8c70da223ed5ab42145800d6b5< 2c1fadd221b21d8038acfe6a0f56291881d5ff76 affected
c656aa4c27b17a8c70da223ed5ab42145800d6b5< f48ab6ee654ecc350434e4566bc785773f412b7e affected
c656aa4c27b17a8c70da223ed5ab42145800d6b5< ad2f60de5045bfb5d20ea468a97c8760c6a3a4f8 affected
c656aa4c27b17a8c70da223ed5ab42145800d6b5< cf2ff10183204349edfd6b972e189375fc5f1fb0 affected
c656aa4c27b17a8c70da223ed5ab42145800d6b5< 30fe3f5f6494f827d812ff179f295a8e532709d6 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-43032

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NFC: pn533: bound the UART receive buffer
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: NFC: pn533: bound the UART receive buffer pn532_receive_buf() appends every incoming byte to dev->recv_skb and only resets the buffer after pn532_uart_rx_is_frame() recognizes a complete frame. A continuous stream of bytes without a valid PN532 frame header therefore keeps growing the skb until skb_put_u8() hits the tail limit. Drop the accumulated partial frame once the fixed receive buffer is full so malformed UART traffic cannot grow the skb past PN532_UART_SKB_BUFF_LEN.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于NFC pn533驱动中UART接收缓冲区未绑定，导致恶意畸形UART流量可使skb无限增长直至达到尾部限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c656aa4c27b17a8c70da223ed5ab42145800d6b5 ~ 8bedf1dd5640ac8997bff00bbefe241b438df397 -
Linux Linux 5.5 -

II. Public POCs for CVE-2026-43032

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-43032

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-43032 (8)

Same Patch Batch · Linux · 2026-05-01 · 146 CVEs total

CVE-2026-43011 9.8 CRITICAL net/x25: Fix potential double free of skb
CVE-2026-43037 9.8 CRITICAL ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
CVE-2026-31705 9.8 CRITICAL ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
CVE-2026-43038 9.8 CRITICAL ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
CVE-2026-43039 9.8 CRITICAL net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
CVE-2026-31718 9.8 CRITICAL ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
CVE-2026-43018 8.8 HIGH Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
CVE-2026-31773 8.8 HIGH Bluetooth: SMP: derive legacy responder STK authentication from MITM state
CVE-2026-31739 8.8 HIGH crypto: tegra - Add missing CRYPTO_ALG_ASYNC
CVE-2026-31735 8.8 HIGH iommupt: Fix short gather if the unmap goes into a large mapping
CVE-2026-31717 8.8 HIGH ksmbd: validate owner of durable handle on reconnect
CVE-2026-43048 8.8 HIGH HID: core: Mitigate potential OOB by removing bogus memset()
CVE-2026-31709 8.8 HIGH smb: client: validate the whole DACL before rewriting it in cifsacl
CVE-2026-31706 8.8 HIGH ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
CVE-2026-31712 8.3 HIGH ksmbd: require minimum ACE size in smb_check_perm_dacl()
CVE-2026-31771 8.1 HIGH Bluetooth: hci_event: move wake reason storage into validated event handlers
CVE-2026-31779 8.1 HIGH wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
CVE-2026-43051 8.1 HIGH HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
CVE-2026-31708 8.1 HIGH smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
CVE-2026-31695 7.8 HIGH wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free

Showing top 20 of 146 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-43032

No comments yet

Leave a comment