The Linux kernel NFC driver for the pn532 contains a flaw where each incoming UART byte is appended to a socket buffer (dev->recv_skb) without resetting until a complete frame header is detected. A continuous stream of bytes that does not form a valid PN532 frame header causes the buffer to grow until it reaches the tail limit defined by skb_put_u8(). This buffer overrun can consume kernel memory and, based on the description, it is inferred that an overflow may result in memory corruption or a system crash, leading to denial of service.

All Linux kernel releases that include the pn532 NFC driver without the binding fix are affected, including active kernel branches up to Linux 7.0 release candidates. Any system running these kernels and using a pn532 NFC device is potentially exposed until the vendor’s patch is applied. The relevant patches and commit references are provided in the CVE references list.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% reflects a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or device-controlled, requiring the attacker to inject malformed UART traffic to the pn532 device; based on the description, it is inferred that such an attack would need physical or direct device access. Although no public exploits have been reported, the potential for memory exhaustion warrants caution.