Critical Vulnerability in Linux Kernel NFC Driver: CVE-2025-38416
Summary
CVE-2025-38416: In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty->disc_data only in success path Setting tty->disc_data before opening the NCI device means we need to clean it up on error paths... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including various distributions of Debian. It manages hardware resources and provides essential services for software applications. The NFC (Near Field Communication) subsystem in the Linux kernel allows devices to communicate wirelessly over short distances. This vulnerability specifically affects the NFC driver related to UART (Universal Asynchronous Receiver-Transmitter) communication, which is crucial for handling data transmission in NFC-enabled devices.
Vulnerability Detail
CVE-2025-38416 is a vulnerability in the Linux kernel's NFC subsystem, specifically in the NCI (NFC Controller Interface) UART driver. The issue arises from the improper handling of the 'tty->disc_data' variable, which is set before the successful opening of the NCI device. This can lead to a situation where the system may attempt to use this variable even if the device initialization fails, potentially exposing the system to data corruption or unexpected behavior. The vulnerability is particularly concerning as it could allow for data to be sent before the device is fully operational, creating a window of opportunity for exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-38416 is a critical vulnerability in the Linux kernel's NFC subsystem that requires immediate attention. Users are advised to update their kernel to the patched version to protect their systems from potential exploitation. Regular monitoring of vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38416 is a vulnerability in the Linux kernel's NFC subsystem that affects the handling of data transmission in NFC devices.
This vulnerability could lead to data corruption or unexpected behavior in NFC-enabled devices, potentially allowing unauthorized access or manipulation of data.
Yes, a patched version of the Linux kernel is available for Debian 13, specifically version 6.12.35-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
