The vulnerability resides in the pn533 NFC driver in the Linux kernel. The driver incorrectly allocates a receive buffer (rx skb) only after consuming incoming bytes. If the memory allocation fails, the driver reports zero bytes received while some bytes have already been consumed, leaving the receive buffer pointer NULL for the next callback. During the subsequent processing of the next byte, the driver performs a dereference of this NULL pointer, which causes a kernel fault and results in a system crash. This constitutes a NULL pointer dereference (CWE‑476) and can be triggered by sending malformed frames to the NFC device.

This issue affects any Linux kernel that includes pn533 support, including kernel versions 5.5 and the 7.0 release candidates 1 through 7, as well as future Linux kernel releases. The affected product is the Linux kernel's NFC subsystem, and the vulnerability is tied to the pn533 driver. Systems that expose the NFC functionality are in scope.

The CVSS score is 5.5, indicating moderate severity, while the EPSS score is below 1 %, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker able to communicate with the pn533 NFC device, such as a malicious NFC tag or a device that can inject frames into the driver. Since the bug arises from a failed memory allocation, the attacker would need to maneuver the system into memory pressure or supply specially crafted frames to trigger the fault. Administrators should therefore apply the latest kernel patch that fixes the allocation logic, or disable the NFC driver if the functionality is unnecessary.