CVE-2026-90221
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse the CORE_INIT_RSP packet without validating that the skb contains enough data. A malformed response (e.g. injected via virtual_ncidev) can declare a large num_supported_rf_interfaces while providing insufficient data, causing reads of uninitialized slab memory. This is later used in nci_init_complete_req(), triggering a KMSAN uninit-value warning. Add skb length checks before accessing packet fields: - Validate the skb has at least 1 byte for the status field. - Validate the skb can hold the fixed-size header before parsing. - In v2, bounds-check each variable-length rf_interface entry and its extension parameters within the parsing loop. - In v1, verify the skb is large enough for both the variable-length rf_interfaces array and the trailing rsp_2 structure.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-17 17:17:17.550000
Last modified
2026-10-19 09:19:12.287000
View original CVE JSON
{
"id": "CVE-2026-90221",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-17T17:17:17.550",
"lastModified": "2026-10-19T09:19:12.287",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing\n\nnci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse\nthe CORE_INIT_RSP packet without validating that the skb contains\nenough data. A malformed response (e.g. injected via virtual_ncidev)\ncan declare a large num_supported_rf_interfaces while providing\ninsufficient data, causing reads of uninitialized slab memory. This\nis later used in nci_init_complete_req(), triggering a KMSAN\nuninit-value warning.\n\nAdd skb length checks before accessing packet fields:\n- Validate the skb has at least 1 byte for the status field.\n- Validate the skb can hold the fixed-size header before parsing.\n- In v2, bounds-check each variable-length rf_interface entry and its\n extension parameters within the parsing loop.\n- In v1, verify the skb is large enough for both the variable-length\n rf_interfaces array and the trailing rsp_2 structure."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/nfc/nci/rsp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "bcd684aace34fedbd473fbd9b21ed06b0c2d2212",
"lessThan": "baed3fdf6ed2195c56f25ae18a086b938dcd3983",
"versionType": "git",
"status": "affected"
},
{
"version": "bcd684aace34fedbd473fbd9b21ed06b0c2d2212",
"lessThan": "2f434478771a4ebdd535033561c0590bcde39753",
"versionType": "git",
"status": "affected"
},
{
"version": "bcd684aace34fedbd473fbd9b21ed06b0c2d2212",
"lessThan": "5487f04c1ccbfa15aa6e531eb1ec9c9ec9c7bf31",
"versionType": "git",
"status": "affected"
},
{
"version": "bcd684aace34fedbd473fbd9b21ed06b0c2d2212",
"lessThan": "bbe68e8249e2c76d65adfd9224fa95f1ca0fbe4e",
"versionType": "git",
"status": "affected"
},
{
"version": "bcd684aace34fedbd473fbd9b21ed06b0c2d2212",
"lessThan": "4f0483bbcdaccc9d4aee30df7351863334cecfa7",
"versionType": "git",
"status": "affected"
},
{
"version": "bcd684aace34fedbd473fbd9b21ed06b0c2d2212",
"lessThan": "7d44b897bff84edcd4814899314d661ad4956a8e",
"versionType": "git",
"status": "affected"
},
{
"version": "bcd684aace34fedbd473fbd9b21ed06b0c2d2212",
"lessThan": "d56575a2595ee1f597f39e8a1cfb67ed3501678d",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/nfc/nci/rsp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.11",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.11",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.221",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.157",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.110",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.52",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.6",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f434478771a4ebdd535033561c0590bcde39753",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f0483bbcdaccc9d4aee30df7351863334cecfa7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5487f04c1ccbfa15aa6e531eb1ec9c9ec9c7bf31",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7d44b897bff84edcd4814899314d661ad4956a8e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/baed3fdf6ed2195c56f25ae18a086b938dcd3983",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bbe68e8249e2c76d65adfd9224fa95f1ca0fbe4e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d56575a2595ee1f597f39e8a1cfb67ed3501678d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}