CVE-2026-80797
nfc: pn533: purge fragmented skbs during cleanup
Description
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented skbs during cleanup pn53x_common_clean() purges resp_q before freeing the common PN533 state, but it leaves fragment_skb untouched. The fragmentation helpers queue transmit fragments there while sending large initiator or target-mode frames, and those skbs remain owned by the driver until they are sent or discarded. If the device is removed while fragments are still queued, the common cleanup path frees the PN533 state without releasing the queued fragment skbs, leaking them. Purge fragment_skb during cleanup alongside resp_q.
INFO
Published Date :
Sept. 4, 2026, 4:18 p.m.
Last Modified :
Sept. 4, 2026, 4:18 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Purge fragment_skb during cleanup.
- Release owned skbs before freeing state.
- Apply the provided patch for Linux kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-80797.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-80797 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-80797
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-80797 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-80797 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 04, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented skbs during cleanup pn53x_common_clean() purges resp_q before freeing the common PN533 state, but it leaves fragment_skb untouched. The fragmentation helpers queue transmit fragments there while sending large initiator or target-mode frames, and those skbs remain owned by the driver until they are sent or discarded. If the device is removed while fragments are still queued, the common cleanup path frees the PN533 state without releasing the queued fragment skbs, leaking them. Purge fragment_skb during cleanup alongside resp_q. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/80xxx/CVE-2026-80797.json">CVE-2026-80797</a> Added Reference https://git.kernel.org/stable/c/130b5ad4492f8e53d0398ee3af2b0e2388504d11 Added Reference https://git.kernel.org/stable/c/2f5d093194ec24d7c29b91bf7df014924e0f4ea1 Added Reference https://git.kernel.org/stable/c/4a52ec2457ff8c26206fcc20fa1972cc35a678c4 Added Reference https://git.kernel.org/stable/c/5718fc62198c38c2de5316020a90506f9e75e0bb Added Reference https://git.kernel.org/stable/c/9319c3c4962efc8697246b563ea31c6d47f085aa Added Reference https://git.kernel.org/stable/c/d63e85c5d5555fe6aa65155d3a09452597e163c3 Added Reference https://git.kernel.org/stable/c/e169277281373818ae1cedf976aa1e99118fb77d Added Reference https://git.kernel.org/stable/c/e7ed2ea5590fbe2d3be39ee4fb0c758a12e31d0c Added Reference https://git.kernel.org/stable/c/e95beff58b38c871c557bf84e528408283c2c0ad