The Linux NFC s3fwrn5 driver fails to properly handle allocation failures. When a call to alloc_skb() returns NULL, the driver still reports that a frame has been consumed and may leave the receive buffer pointer as NULL. The next use of skb_put_u8() dereferences this NULL pointer, causing a kernel panic. This results in a system crash and loss of availability for the affected host.

All Linux kernel implementations that include the NFC s3fwrn5 driver are affected, regardless of vendor. The vulnerability is present in the mainline kernel until a patch that lazily allocates the receive skb before consuming bytes is applied. No specific version information is provided, so any kernel version that ships a version of the driver that contains the flaw is impacted.

The exploit environment requires the attacker to be able to generate or influence NFC data processed by the s3fwrn5 driver. The exact attack vector – whether local, network, or physical – is not explicitly detailed but the kernel-level nature of the flaw suggests a local or remote application with access to the NFC device could trigger it. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nonetheless, a successful NULL‑dereference results in a kernel panic, so the impact is a denial‑of‑service of the affected machine.