CVE-2026-90222: nfc: pn533: hold a reference to the request skb during send_frame
In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: hold a reference to the request skb during sendframe
pn533sendasync() publishes the command and then calls dev->phyops->sendframe(). Once dev->cmd is set, an incoming frame can be matched to this command: the I2C threaded IRQ runs pn533recvframe(), which queues cmdcompletework, and pn533sendasynccomplete() frees cmd->req with consumeskb().
On the I2C transport, pn533i2csendframe() still dereferences the same skb after i2cmastersend() returns, so a completion that races the send can free the skb while the transport is still using it.
The request skb is owned by the command object and may be freed by command completion at any time after dev->cmd is published, so the transport send path must not assume it stays alive. Hold a temporary reference to the request skb across the sendframe() call so the transport always sees a live skb even if completion races the send. Add a pn533sendcmdframe() helper and use it from all three send paths.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel PN533 NFC driver are affected when its command send path can race with command completion. The described race specifically involves the I2C transport, where the threaded IRQ may complete a command while the send path still dereferences its request skb.
What must occur for the vulnerability to be triggered?
An incoming frame must be matched to a newly published command while send_frame() is still executing. Command completion can then free the command request skb before pn533_i2c_send_frame() has finished using it after i2c_master_send() returns.
How can teams determine whether their kernel includes the fix?
Check whether the PN533 driver holds a temporary reference to the request skb across the send_frame() call, using the pn533_send_cmd_frame() helper from all three send paths. The listed stable kernel references identify commits containing the resolution.
What is the remediation if affected?
Update to a kernel containing the referenced fix. The remediation ensures the request skb remains live throughout the transport send operation even if command completion races with it.