CVE-2026-43291 Git CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, embedded and mobile OEMs, and fleet operators that deploy systems with NFC hardware using the kernel NCI stack.

Technical summary

According to the supplied description, commit 9c328f54741b introduced overly strict parameter validation for packet data in net/nfc/nci. The check failed to account for variable-length packet formats and compared data against the sizeof(struct) maximum, which caused valid communication with NCI NFC chips to stop working. The NVD record lists CVSS 3.1 as AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H and includes several kernel.org stable commit references for remediation.

Defensive priority

High for any environment that uses the Linux kernel NFC NCI subsystem; lower priority for systems that do not use NFC hardware.

Recommended defensive actions

• Apply the kernel update or stable backport that contains the NFC NCI validation fix.
• Inventory devices and fleets that rely on NFC hardware to determine exposure to the kernel NCI path.
• Verify NFC chip communication after patching to confirm normal operation is restored.
• Track vendor kernel advisories and backport status for your Linux distribution or device firmware.
• Prioritize testing in embedded, mobile, and appliance environments where NFC functionality is user-facing or operationally required.

Evidence notes

This debrief is based only on the supplied CVE description, NVD metadata, and the official references listed in the record. The description states that the regression came from commit 9c328f54741b and that the problem was comparing variable-length packet data to a struct size. NVD lists the CVSS vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H and provides multiple kernel.org stable references. No affected version range or exploit details were supplied in the corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.