Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90222— nfc: pn533: hold a reference to the request skb during send_frame

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： nfc: pn533: 在 send_frame 期间持有请求 skb 的引用 会发布命令，然后调用 。一旦 被设置，接收到的帧就可以与该命令进行匹配：I2C 线程化中断处理函数会执行 ，该函数会入队 ，而 会通过 释放 。 在 I2C 传输层中， 在 返回后仍会再次解引用同一个 skb，因此如果完成回调与发送过程发生竞争，可能会在传输层仍在使用该 skb 时将其释放。 请求 skb 由命令对象拥有，且在 发布后的任何时刻都可能被命令完成回调释放，因此传输层的发送路径不能假

AI Predicted 7.1 Difficulty: Hard EPSS 0.21% · P10

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 9815c7cf22daceabfb919ddcd6f2c80e049c1fbc< 8710faddef4ad8b2a6bfa985d896e2e1bfb77018 affected
9815c7cf22daceabfb919ddcd6f2c80e049c1fbc< 19f1239758c23f087f4c25733cfcf62bf0b06051 affected
9815c7cf22daceabfb919ddcd6f2c80e049c1fbc< 7ee72c64b4b66b1b42dbddbca0a80a218f1b9297 affected
9815c7cf22daceabfb919ddcd6f2c80e049c1fbc< 753bdaf3220fe8371a6c3c75da645ea7753d11be affected
9815c7cf22daceabfb919ddcd6f2c80e049c1fbc< d329f61ad5786900334a54c2445dc99feda545bf affected
9815c7cf22daceabfb919ddcd6f2c80e049c1fbc< 7a8e0a7aef80721da287ac246349aba7d98f6aed affected
9815c7cf22daceabfb919ddcd6f2c80e049c1fbc< 3e7a093c177f9f8b9fd039cab41191515079425a affected
9815c7cf22daceabfb919ddcd6f2c80e049c1fbc< 47792358a624ea066455ef86b744159928cd7716 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90222

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nfc: pn533: hold a reference to the request skb during send_frame
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during send_frame __pn533_send_async() publishes the command and then calls dev->phy_ops->send_frame(). Once dev->cmd is set, an incoming frame can be matched to this command: the I2C threaded IRQ runs pn533_recv_frame(), which queues cmd_complete_work, and pn533_send_async_complete() frees cmd->req with consume_skb(). On the I2C transport, pn533_i2c_send_frame() still dereferences the same skb after i2c_master_send() returns, so a completion that races the send can free the skb while the transport is still using it. The request skb is owned by the command object and may be freed by command completion at any time after dev->cmd is published, so the transport send path must not assume it stays alive. Hold a temporary reference to the request skb across the send_frame() call so the transport always sees a live skb even if completion races the send. Add a pn533_send_cmd_frame() helper and use it from all three send paths.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 9815c7cf22daceabfb919ddcd6f2c80e049c1fbc ~ 8710faddef4ad8b2a6bfa985d896e2e1bfb77018 -
Linux Linux 4.7 -

II. Public POCs for CVE-2026-90222

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90222

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90222 (8)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90286 8.8 HIGH drm/amdgpu/gfx6: Use PFP on the compute queues too
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90380 8.8 HIGH wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90162 8.8 HIGH ksmbd: defer publishing granted locks to prevent UAF/double-free race
CVE-2026-90379 8.8 HIGH wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90371 8.8 HIGH wifi: mt76: fix RXDMAD_C buffer recycling race

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90222

No comments yet

Leave a comment