LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40043: net: nfc: nci: Add parameter validation for packet data

In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized value bug in nci_init_req, which was introduced by commit 5aca7966d2a7 ("Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools"). This bug arises due to very limited and poor input validation that was done at nic_valid_size(). This validation only validates the skb->len (directly reflects size provided at the userspace interface) with the length provided in the buffer itself (interpreted as NCI_HEADER). This leads to the processing of memory content at the address assuming the correct layout per what opcode requires there. This leads to the accesses to buffer of `skb_buff->data` which is not assigned anything yet. Following the same silent drop of packets of invalid sizes at `nic_valid_size()`, add validation of the data in the respective handlers and return error values in case of failure. Release the skb if error values are returned from handlers in `nci_nft_packet` and effectively do a silent drop Possible TODO: because we silently drop the packets, the call to `nci_request` will be waiting for completion of request and will face timeouts. These timeouts can get excessively logged in the dmesg. A proper handling of them may require to export `nci_request_cancel` (or propagate error handling from the nft packets handlers).

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel NFC component did not adequately validate packet contents before using them. Malformed input could make the kernel process uninitialized memory. The supplied assessment rates potential confidentiality, integrity, and availability impact as high, but the bundle does not document a demonstrated exploit or specific real-world outcome.

Executive priority

Treat this as a high-priority kernel update for NFC-capable Linux assets, especially exposed endpoints and embedded devices. First establish whether NFC/NCI is enabled and whether vendor kernels contain the fix. Accelerate patching where both conditions indicate exposure; avoid assuming the raw version list maps cleanly to distribution packages.

Technical view

NCI handlers validated packet length insufficiently, then interpreted buffer contents according to an opcode-specific layout. This could cause nci_init_req and related processing to access uninitialized skb data. The referenced stable fixes add handler-level parameter validation, return errors for invalid data, release the skb, and silently discard malformed packets.

Likely exposure

Potential exposure is limited to systems running affected Linux kernel builds where the NFC/NCI path is present and reachable. The supplied version data is ambiguous, containing repeated commit identifiers and a “0” entry. Determine exposure through distribution advisories, installed kernel packages, configuration, and presence of the applicable fix commit.

Exploitation context

The bundle provides no evidence of active exploitation, and the CVE is not identified as KEV. CVSS 3.1 rates it 8.8 with an adjacent attack vector, no privileges, and no user interaction. The description also references userspace-provided packet sizes, so the exact practical attack path is not fully clarified.

Researcher notes

Syzbot identified an uninitialized-value condition in nci_init_req. The correction strengthens validation inside individual handlers rather than relying only on packet-length comparison. Invalid packets are silently dropped. The source notes that associated requests may subsequently time out and generate excessive kernel logging; this operational symptom is not evidence of exploitation.

Mitigation direction

  • Apply the distribution or vendor kernel update incorporating the applicable referenced Linux stable fix.
  • Check vendor guidance for precise affected-build mapping and any supported interim mitigation.
  • Prioritize remediation on systems with NFC/NCI enabled or reachable by untrusted packet input.

Validation and detection

  • Inventory kernel builds and compare them with distribution advisories and the referenced fix commits.
  • Confirm whether NFC and the NCI subsystem are enabled or used on each system.
  • Verify updated kernels contain the applicable parameter-validation fix before closing remediation.
  • Review kernel logs for NFC/NCI errors or repeated request timeouts, without treating them as exploitation proof.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40043 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2025-40043Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6a2968aaf50c7a22fced77a5e24aa636281efca8, 6a2968aaf50c7a22fced77a5e24aa636281efca8, 6a2968aaf50c7a22fced77a5e24aa636281efca8, 6a2968aaf50c7a22fced77a5e24aa636281efca8, 6a2968aaf50c7a22fced77a5e24aa636281efca8, 6a2968aaf50c7a22fced77a5e24aa636281efca8unaffected
LinuxLinux3.2, 0, 5.15.195, 6.1.156, 6.6.112, 6.12.53, 6.17.3, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.