CVE-2025-40043

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: nfc: nci: Add parameter validation for packet data

Syzbot reported an uninitialized value bug in nci_init_req, which was

introduced by commit 5aca7966d2a7 ("Merge tag

'perf-tools-fixes-for-v6.17-2025-09-16' of

git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools").

This bug arises due to very limited and poor input validation

that was done at nic_valid_size(). This validation only

validates the skb->len (directly reflects size provided at the

userspace interface) with the length provided in the buffer

itself (interpreted as NCI_HEADER). This leads to the processing

of memory content at the address assuming the correct layout

per what opcode requires there. This leads to the accesses to

buffer of `skb_buff->data` which is not assigned anything yet.

Following the same silent drop of packets of invalid sizes at

`nic_valid_size()`, add validation of the data in the respective

handlers and return error val

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References