CVE-2026-80797 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: purge fragmented skbs during cleanup
pn53x_common_clean() purges resp_q before freeing the common PN533 state, but it leaves fragment_skb untouched. The fragmentation helpers queue transmit fragments there while sending large initiator or target-mode frames, and those skbs remain owned by the driver until they are sent or discarded.
If the device is removed while fragments are still queued, the common cleanup path frees the PN533 state without releasing the queued fragment skbs, leaking them.
Purge fragment_skb during cleanup alongside resp_q.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in the Linux kernel's Near Field Communication (NFC) subsystem specifically affects the pn533 driver, which manages communication with NXP PN53x NFC controllers. This issue manifests as a memory leak resulting from improper resource management during device teardown operations. The core of the problem lies within the cleanup routine, specifically the function responsible for releasing shared resources associated with the common PN533 state. While this routine correctly purges the response queue to prevent dangling pointers or lost data packets, it fails to address the fragment_skb buffer. This specific buffer is utilized by fragmentation helpers that handle large frames transmitted in either initiator or target modes. When such large data units are processed, they are split into smaller segments queued within this structure for transmission. These socket buffers remain owned by the driver until they are successfully sent or explicitly discarded, creating a dependency on proper cleanup logic to reclaim memory resources.
The operational impact of this flaw becomes apparent when an NFC device is physically removed from the system while fragmented data frames are still pending in the queue. In such scenarios, the kernel's standard device removal path triggers the common cleanup sequence. Because the fragment_skb buffer is not purged during this phase, the socket buffers allocated for these incomplete transmissions are never freed. Consequently, each instance of premature device disconnection results in a permanent loss of memory within the kernel space. Over time, particularly on systems with frequent NFC device hot-plugging or unstable connections, this cumulative leakage can lead to significant resource exhaustion. This degradation may eventually cause system instability, reduced performance due to increased pressure on the memory allocator, or even kernel panics if sufficient contiguous memory becomes unavailable for other critical operations.
From a technical classification perspective, this vulnerability aligns with CWE-401, which describes a missing release of memory after effective usage. The flaw represents a classic resource management error where cleanup procedures are incomplete, leaving allocated resources unreleased under specific edge cases involving device removal during active data transmission. In the context of the MITRE ATT&CK framework for enterprise security, this type of vulnerability can be leveraged in denial-of-service attacks by an attacker with local access to trigger repeated device disconnects or manipulate driver states to accelerate memory exhaustion. Although typically classified as a low-severity issue due to its localized nature and requirement for physical interaction or specific timing conditions, it underscores the importance of rigorous resource lifecycle management within kernel drivers handling external hardware interfaces.
To mitigate this vulnerability, developers must ensure that all dynamically allocated buffers associated with device operations are properly released during every possible exit path, including error handlers and removal routines. The fix involves modifying the cleanup function to explicitly purge the fragment_skb buffer alongside the response queue before freeing the common PN533 state structure. This ensures that any queued transmit fragments are discarded and their memory returned to the system pool regardless of whether transmission was completed or interrupted by device removal. System administrators should apply kernel updates containing this patch as soon as they become available through their distribution's security channels. Regular auditing of driver cleanup paths for similar omissions is recommended to maintain overall system stability and prevent resource leaks in other network-facing components within the Linux ecosystem.