nfc: pn533: allocate rx skb before consuming bytes
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: allocate rx skb before consuming bytes pn532_receive_buf() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already hand a complete frame to pn533_recv_frame() before allocating a fresh receive buffer. If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8(). Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.253, 5.15.203, 6.1.169, 6.12.82, 6.18.23, 6.19.13, 6.6.135
- CVEs
- CVE-2026-31660
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 03:18 UTC · Revision 1
Source evidence
nfc: pn533: allocate rx skb before consuming bytes
core-osv · Original sourcePublished 24 Apr 2026, 14:45 UTC
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: allocate rx skb before consuming bytes pn532_receive_buf() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already hand a complete frame to pn533_recv_frame() before allocating a fresh receive buffer. If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8(). Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted.
osv:CVE-2026-31660
Kernel
Fixed versions: 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13
Complete source record
{
"id": "fde34f7a2441325af224d7ec9f6cd2f80c969b9ec93a87eec0d26c50434848da",
"url": "https://osv.dev/vulnerability/CVE-2026-31660",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "nfc: pn533: allocate rx skb before consuming bytes",
"summary": "In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: allocate rx skb before consuming bytes pn532_receive_buf() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already hand a complete frame to pn533_recv_frame() before allocating a fresh receive buffer. If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8(). Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted.",
"evidence": "osv:CVE-2026-31660",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.253",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.203",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.169",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.135",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.82",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.23",
"evidence": "/affected/1/ranges"
},
{
"value": "6.19.13",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-31660",
"aliases": [
"CVE-2026-31660"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c656aa4c27b17a8c70da223ed5ab42145800d6b5"
},
{
"fixed": "2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb"
},
{
"fixed": "8b71299d587d9e4c830c18afb884c80ddb30ad28"
},
{
"fixed": "16649adc2e19509104245ea1f349b629d858f11f"
},
{
"fixed": "07cb6c72e66ba548679f22ac29ad588da8999279"
},
{
"fixed": "a9495069b43b8634c1ae0042e888766c34f66637"
},
{
"fixed": "21ae2cda66a55c759607bbf1d23cbaa42019d2de"
},
{
"fixed": "7e37da42eda45d7859d9273fc7e225d8df458038"
},
{
"fixed": "c71ba669b570c7b3f86ec875be222ea11dacb352"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31660.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.253"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.203"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.169"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.135"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.82"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.23"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "6.19.13"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31660.json"
}
}
],
"modified": "2026-10-28T02:30:42.111604723Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/07cb6c72e66ba548679f22ac29ad588da8999279",
"https://git.kernel.org/stable/c/16649adc2e19509104245ea1f349b629d858f11f",
"https://git.kernel.org/stable/c/21ae2cda66a55c759607bbf1d23cbaa42019d2de",
"https://git.kernel.org/stable/c/2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb",
"https://git.kernel.org/stable/c/7e37da42eda45d7859d9273fc7e225d8df458038",
"https://git.kernel.org/stable/c/8b71299d587d9e4c830c18afb884c80ddb30ad28",
"https://git.kernel.org/stable/c/a9495069b43b8634c1ae0042e888766c34f66637",
"https://git.kernel.org/stable/c/c71ba669b570c7b3f86ec875be222ea11dacb352",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31660.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-31660",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31660.json"
}
},
"related_cves": [
{
"value": "CVE-2026-31660",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 509806,
"published_at": "2026-04-24T14:45:11.039+00:00"
}