CVE-2025-40043
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized value bug in nci_init_req, which was introduced by commit 5aca7966d2a7 ("Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools"). This bug arises due to very limited and poor input validation that was done at nic_valid_size(). This validation only validates the skb->len (directly reflects size provided at the userspace interface) with the length provided in the buffer itself (interpreted as NCI_HEADER). This leads to the processing of memory content at the address assuming the correct layout per what opcode requires there. This leads to the accesses to buffer of `skb_buff->data` which is not assigned anything yet. Following the same silent drop of packets of invalid sizes at `nic_valid_size()`, add validation of the data in the respective handlers and return error values in case of failure. Release the skb if error values are returned from handlers in `nci_nft_packet` and effectively do a silent drop Possible TODO: because we silently drop the packets, the call to `nci_request` will be waiting for completion of request and will face timeouts. These timeouts can get excessively logged in the dmesg. A proper handling of them may require to export `nci_request_cancel` (or propagate error handling from the nft packets handlers).
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-28 12:15:38.333000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-40043",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-28T12:15:38.333",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nfc: nci: Add parameter validation for packet data\n\nSyzbot reported an uninitialized value bug in nci_init_req, which was\nintroduced by commit 5aca7966d2a7 (\"Merge tag\n'perf-tools-fixes-for-v6.17-2025-09-16' of\ngit://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools\").\n\nThis bug arises due to very limited and poor input validation\nthat was done at nic_valid_size(). This validation only\nvalidates the skb->len (directly reflects size provided at the\nuserspace interface) with the length provided in the buffer\nitself (interpreted as NCI_HEADER). This leads to the processing\nof memory content at the address assuming the correct layout\nper what opcode requires there. This leads to the accesses to\nbuffer of `skb_buff->data` which is not assigned anything yet.\n\nFollowing the same silent drop of packets of invalid sizes at\n`nic_valid_size()`, add validation of the data in the respective\nhandlers and return error values in case of failure. Release\nthe skb if error values are returned from handlers in\n`nci_nft_packet` and effectively do a silent drop\n\nPossible TODO: because we silently drop the packets, the\ncall to `nci_request` will be waiting for completion of request\nand will face timeouts. These timeouts can get excessively logged\nin the dmesg. A proper handling of them may require to export\n`nci_request_cancel` (or propagate error handling from the\nnft packets handlers)."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: nfc: nci: Añadir validación de parámetros para datos de paquete\n\nSyzbot informó un error de valor no inicializado en nci_init_req, que fue introducido por el commit 5aca7966d2a7 ('Fusionar etiqueta 'perf-tools-fixes-for-v6.17-2025-09-16' de git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools').\n\nEste error surge debido a una validación de entrada muy limitada y deficiente que se realizó en nic_valid_size(). Esta validación solo valida el skb->len (refleja directamente el tamaño proporcionado en la interfaz de espacio de usuario) con la longitud proporcionada en el propio búfer (interpretada como NCI_HEADER). Esto lleva al procesamiento de contenido de memoria en la dirección asumiendo el diseño correcto según lo que el código de operación requiere allí. Esto lleva a los accesos al búfer de 'skb_buff->data' al que aún no se le ha asignado nada.\n\nSiguiendo la misma caída silenciosa de paquetes de tamaños inválidos en 'nic_valid_size()', añadir validación de los datos en los manejadores respectivos y devolver valores de error en caso de fallo. Liberar el skb si se devuelven valores de error de los manejadores en 'nci_nft_packet' y realizar efectivamente una caída silenciosa.\n\nPosible PENDIENTE: debido a que descartamos silenciosamente los paquetes, la llamada a 'nci_request' estará esperando la finalización de la solicitud y se enfrentará a tiempos de espera. Estos tiempos de espera pueden ser registrados excesivamente en el dmesg. Un manejo adecuado de ellos puede requerir exportar 'nci_request_cancel' (o propagar el manejo de errores desde los manejadores de paquetes nft)."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/nfc/nci/ntf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"lessThan": "8fcc7315a10a84264e55bb65ede10f0af20a983f",
"versionType": "git",
"status": "affected"
},
{
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"lessThan": "bfdda0123dde406dbff62e7e9136037e97998a15",
"versionType": "git",
"status": "affected"
},
{
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"lessThan": "0ba68bea1e356f466ad29449938bea12f5f3711f",
"versionType": "git",
"status": "affected"
},
{
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"lessThan": "74837bca0748763a77f77db47a0bdbe63b347628",
"versionType": "git",
"status": "affected"
},
{
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"lessThan": "c395d1e548cc68e84584ffa2e3ca9796a78bf7b9",
"versionType": "git",
"status": "affected"
},
{
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"lessThan": "9c328f54741bd5465ca1dc717c84c04242fac2e1",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/nfc/nci/ntf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.2",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.2",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.195",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.156",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.112",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.53",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.3",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ba68bea1e356f466ad29449938bea12f5f3711f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/74837bca0748763a77f77db47a0bdbe63b347628",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8fcc7315a10a84264e55bb65ede10f0af20a983f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9c328f54741bd5465ca1dc717c84c04242fac2e1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bfdda0123dde406dbff62e7e9136037e97998a15",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c395d1e548cc68e84584ffa2e3ca9796a78bf7b9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}