CVE-2025-21735

CVE-2025-21735 affects the Linux kernel NFC (nci) component, specifically nci_hci_create_pipe(). The pipe value is a net-sourced u8; if it exceeds 127, it can cause memory corruption in the caller, nci_hci_connect_gate(), per the advisory. The description confirms the issue has been resolved in t...

CVE-2025-21735 NFC: nci: Add bounds checking in nci_hci_create_pipe()

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking in ncihcicreatepipe The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, ncihciconnectgate...

CVE-2025-21735 NFC: nci: Add bounds checking in nci_hci_create_pipe()

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking in ncihcicreatepipe The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, ncihciconnectgate...

CVE-2022-49505

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

UBUNTU-CVE-2022-49331

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: fix memory leaks in EVTTRANSACTION handling Error paths do not free previously allocated memory. Add devmkfree to those failure paths...

UBUNTU-CVE-2022-49505

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

CVE-2022-49059

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flushworkqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism timer and...

CVE-2022-49505

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

CVE-2022-49505 NFC: NULL out the dev->rfkill to prevent UAF

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

CVE-2022-49505 NFC: NULL out the dev->rfkill to prevent UAF

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

CVE-2022-49505 NFC: NULL out the dev->rfkill to prevent UAF

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

CVE-2022-49505

Mode C: The CVE-2022-49505 issue affects the Linux kernel NFC subsystem. The root cause is a UAF (use-after-free) of the rfkill object in the NFC device handling: during nfc_dev_up() and related operations, the rfkill state could be dereferenced if the device is removed via nfc_unregister_device(...

CVE-2022-49331

In the Linux kernel, the nfc: st21nfca driver was fixed to address memory leaks in EVT_TRANSACTION handling. The error paths did not free previously allocated memory, and the patch adds devm_kfree() to those failure paths to prevent leaks. The CVE entry CVE-2022-49331 reflects this fix. The avail...

CVE-2022-49331 nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: fix memory leaks in EVTTRANSACTION handling Error paths do not free previously allocated memory. Add devmkfree to those failure paths...

CVE-2022-49059 nfc: nci: add flush_workqueue to prevent uaf

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flushworkqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism timer and...

CVE-2022-49059 nfc: nci: add flush_workqueue to prevent uaf

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flushworkqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism timer and...

CVE-2022-49059 nfc: nci: add flush_workqueue to prevent uaf

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flushworkqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism timer and...

CVE-2022-49505: Use After Free

In the Linux kernel, the following vulnerability has been resolved: NFC: NULL out the dev-rfkill to prevent UAF Commit 3e3b5dfcd16a "NFC: reorder the logic in nfcun,registerdevice" assumes the deviceisregistered in function nfcdevup will help to check when the rfkill is unregistered. However, thi...

CVE-2022-49331: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: fix memory leaks in EVTTRANSACTION handling Error paths do not free previously allocated memory. Add devmkfree to those failure paths...

CVE-2022-49059: Use After Free

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flushworkqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism timer and...