| Published | Title | Version | Author | Status |
|---|---|---|---|---|
| 2026-11-09 03:18 UTC | NFC: digital: fix target leak after Type 1 Tag discovery | 1 | yanxia@cmss.chinamobile.com | - |
| 2026-11-07 06:19 UTC | nfc: digital: fix use-after-free in unregister | 2 | xuyuqiabc@gmail.com | - |
| 2026-11-05 11:38 UTC | nfc: rawsock: serialize SEND_SHUTDOWN with the TX work requeue | 2 | shunsheng1218@gmail.com | finished in 3h51m0s |
| 2026-11-05 10:58 UTC | nfc: pn533: validate response length before parsing DEP ATR_RES | 1 | hj351016@gmail.com | finished in 4h4m0s |
| 2026-11-05 10:39 UTC | nfc: pn533: validate response length before parsing DEP ATR_RES | 1 | hj351016@gmail.com | finished in 3h48m0s |
| 2026-11-04 09:51 UTC | nfc: rawsock: prevent TX work requeue after socket shutdown | 1 | shunsheng1218@gmail.com | finished in 4h25m0s |
| 2026-11-04 06:20 UTC | nfc: order NCI UART and firmware teardown | 7 | shubham@octane.security | finished in 1h37m0s |
| 2026-11-04 02:28 UTC | nfc: llcp: put the socket reference on a refused connection | 1 | vulab@iscas.ac.cn | finished in 4h44m0s |
| 2026-11-04 02:28 UTC | nfc: llcp: drop the socket reference for non-datagram UI frames | 1 | vulab@iscas.ac.cn | finished in 4h13m0s |
| 2026-11-03 10:42 UTC | nfc: trf7970a: release runtime PM reference on RF-on errors | 1 | vulab@iscas.ac.cn | skipped |
| 2026-10-30 11:10 UTC | nfc: fix skb leaks in LLC nop and in data exchange error paths | 1 | joasantonio108@gmail.com | finished in 4h8m0s |
| 2026-10-30 02:40 UTC | nfc: st21nfca: complete a pending SE APDU request only once | 1 | joasantonio108@gmail.com | skipped |
| 2026-10-30 02:40 UTC | nfc: s3fwrn5: validate the firmware image size against the firmware file | 1 | joasantonio108@gmail.com | skipped |
| 2026-10-29 23:17 UTC | nfc: fix HCI over NCI and NFCC loopback response handling | 1 | joasantonio108@gmail.com | finished in 4h15m0s |
| 2026-10-29 16:24 UTC | nfc: llcp: use disable_work_sync and timer_shutdown_sync in local_cleanup | 2 | tristmd@gmail.com | finished in 4h40m0s |
| 2026-10-26 07:24 UTC | nfc: digital: fix use-after-free in unregister | 1 | xuyuqiabc@gmail.com | finished in 4h6m0s |
| 2026-10-26 07:24 UTC | nfc: llcp: fix use-after-free when purging local | 1 | xuyuqiabc@gmail.com | finished in 4h8m0s |
| 2026-10-23 19:54 UTC | nfc: llcp: use timer_shutdown_sync to prevent timer rearm | 1 | tristmd@gmail.com | finished in 57m0s |
| 2026-10-21 03:24 UTC | nfc: fix NCI UART and firmware teardown races | 6 | shubham@octane.security | finished in 4h0m0s |
| 2026-10-19 14:55 UTC | nfc: pn533: bound the OUT URB wait in pn533_usb_send_frame() | 1 | ngocthang2710.1999@gmail.com | finished in 4h29m0s |
| 2026-10-13 02:57 UTC | nfc: nci: uart: quiesce write_work during teardown | 5 | shubham@octane.security | finished in 1h50m0s |
| 2026-10-09 09:23 UTC | nfc: llcp: fix socket list self-loop and soft lockup on bound connect | 1 | bsdhenrymartin@gmail.com | finished in 3h57m0s |
| 2026-10-06 11:55 UTC | nfc: nci: uart: fix write_work teardown UAF (+ nfcmrvl drv_data) | 4 | shubham@octane.security | finished in 2h6m0s |
| 2026-10-05 20:51 UTC | nfc: st-nci: Fairphone 5 NFC bring-up (ST21NFCD) | 5 | isyourbrainfoss@proton.me | skipped |
| 2026-10-05 13:26 UTC | nfc: nci: fix out-of-bounds read in nci_core_reset_rsp_packet() | 2 | omermetekaya0@gmail.com | skipped |
| 2026-10-05 10:28 UTC | nfc: nci: drain rx_wq before cmd_wq on unregister | 1 | yogeshgaur.83@gmail.com | finished in 3h56m0s |
| 2026-09-30 22:47 UTC | nfc: nci: fix out-of-bounds read in nci_core_reset_rsp_packet() | 1 | omermetekaya0@gmail.com | finished in 4h13m0s |
| 2026-09-30 22:02 UTC | nfc: digital: fix read of resp->data[0] before length check in sens_req | 1 | omermetekaya0@gmail.com | finished in 2h47m0s |
| 2026-09-28 03:57 UTC | nfc: llcp: prevent resource leak on repeated connect after DM | 3 | qwe.aldo@gmail.com | finished in 3h53m0s |
| 2026-09-27 13:29 UTC | nfc: nci: ignore unexpected CORE_RESET_NTF and CORE_RESET_RSP | 3 | ndaugoing@gmail.com | finished in 4h4m0s |
| 2026-09-27 11:59 UTC | nfc: nci: avoid unbounded skb allocation when max_pkt_payload_len is zero | 3 | liuc63@xiaopeng.com | finished in 4h27m0s |
| 2026-09-26 21:20 UTC | nfc: llcp: clear device pointer on disconnect | 1 | qwe.aldo@gmail.com | finished in 4h6m0s |
| 2026-09-26 14:49 UTC | nfc: port100: cancel a stale out URB before sending a command | 1 | ngocthang2710.1999@gmail.com | finished in 4h3m0s |
| 2026-09-25 18:48 UTC | nfc: llcp: prevent resource leak on repeated connect after DM | 2 | qwe.aldo@gmail.com |
finished
in 4h7m0s
[2 findings] |
| 2026-09-25 17:58 UTC | nfc: nxp-nci: fix IRQ use-after-free in i2c remove | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-25 13:41 UTC | selftests/nci: skip when the virtual NCI device is absent | 1 | eva.kurchatova@virtuozzo.com | skipped |
| 2026-09-23 13:33 UTC | nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() | 1 | qwe.aldo@gmail.com | finished in 4h12m0s |
| 2026-09-22 10:21 UTC | nfc: nci: ignore unexpected CORE_RESET_NTF and CORE_RESET_RSP | 2 | ndaugoing@gmail.com | finished in 4h58m0s |
| 2026-09-22 08:07 UTC | nfc: nci: ignore unexpected CORE_RESET_NTF and CORE_RESET_RSP | 2 | ndaugoing@gmail.com | finished in 4h26m0s |
| 2026-09-18 18:54 UTC | nfc: nci: avoid unbounded skb allocation when max_pkt_payload_len is zero | 2 | liuc63@xiaopeng.com | finished in 4h37m0s |
| 2026-09-18 03:39 UTC | nfc: llcp: reject connect() on sockets not in LLCP_CLOSED state | 1 | ndaugoing@gmail.com | finished in 4h10m0s |
| 2026-09-18 02:04 UTC | nfc: nci: do not process unexpected or invalid CORE_CONN_CREATE_RSP | 1 | ndaugoing@gmail.com | finished in 4h11m0s |
| 2026-09-18 01:33 UTC | nfc: nci: ignore unexpected CORE_RESET_NTF | 1 | ndaugoing@gmail.com | finished in 4h14m0s |
| 2026-09-17 16:38 UTC | nfc: llcp: Fix local use-after-free in nfc_llcp_general_bytes() | 1 | vulab@iscas.ac.cn | finished in 4h6m0s |
| 2026-09-17 12:25 UTC | NFC: trf7970a: Fix runtime PM leak in trf7970a_switch_rf_on() | 1 | vulab@iscas.ac.cn | skipped |
| 2026-09-16 07:34 UTC | nfc: llcp: Fix socket reference leak in nfc_llcp_recv_ui() | 1 | vulab@iscas.ac.cn | finished in 4h19m0s |
| 2026-09-15 18:54 UTC | nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() | 2 | elb12345@hotmail.co.uk | finished in 4h20m0s |
| 2026-09-14 12:11 UTC | nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure | 1 | congnt264@gmail.com | finished in 5h27m0s |
| 2026-09-13 20:24 UTC | nfc: digital: check DEP_REQ length before reading DID byte | 3 | elb12345@hotmail.co.uk | finished in 1h49m0s |
| 2026-09-13 10:13 UTC | nfc: nci: avoid unbounded skb allocation when max_pkt_payload_len is zero | 1 | liuc63@xiaopeng.com | finished in 3h58m0s |
| 2026-09-13 04:26 UTC | nfc: trf7970a: power down on startup RX gain failure | 1 | mhun512@gmail.com | skipped |
| 2026-09-12 16:52 UTC | nfc: nci: validate CORE_CONN_CREATE response length before reading fields | 2 | elb12345@hotmail.co.uk | finished in 3h45m0s |
| 2026-09-12 13:19 UTC | nfc: digital: check DEP_REQ length before reading DID byte | 2 | elb12345@hotmail.co.uk | finished in 1h38m0s |
| 2026-09-12 13:18 UTC | nfc: digital: fix two bugs in NFC-DEP chaining and frame handling | 1 | liuc63@xiaopeng.com | finished in 1h46m0s |
| 2026-09-12 11:57 UTC | nfc: hci: add bounds checking in nfc_hci_create_pipe() | 1 | liuc63@xiaopeng.com | finished in 2h29m0s |
| 2026-09-09 05:19 UTC | net: nfc: fix use-after-free in nfc_get_local_general_bytes | 3 | weir@nebusec.ai | finished in 4h2m0s |
| 2026-09-07 06:28 UTC | nfc: nci: validate CORE_CONN_CREATE response length before reading fields | 1 | elb12345@hotmail.co.uk | finished in 4h14m0s |
| 2026-09-06 00:38 UTC | nfc: llcp: fix slab-out-of-bounds reads when logging service names | 3 | omermetekaya0@gmail.com | skipped |
| 2026-09-05 22:48 UTC | nfc: llcp: fix slab-out-of-bounds read in nfc_llcp_wks_sap() | 2 | omermetekaya0@gmail.com | skipped |
| 2026-09-04 16:42 UTC | nfc: virtual_ncidev: Add missing ioctl compat handler | 1 | christian.gellermann@codasip.com | finished in 1h35m0s |
| 2026-09-04 09:59 UTC | selftests/nci: Fix out-of-bounds store on thread join | 1 | christian.gellermann@codasip.com | skipped |
| 2026-09-03 16:49 UTC | nfc: llcp: fix slab-out-of-bounds read in nfc_llcp_wks_sap() | 1 | omermetekaya0@gmail.com | skipped |
| 2026-09-02 21:22 UTC | nfc: st-nci: Fairphone 5 NFC bring-up (ST21NFCD) | 4 | isyourbrainfoss@proton.me | skipped |
| 2026-09-02 12:30 UTC | nfc: llcp: Fix race condition in accept_queue lifecycle | 3 | lee@kernel.org | finished in 4h52m0s |
| 2026-09-01 14:47 UTC | net: nfc: Fix use-after-free in general bytes retrieval | 2 | weir@nebusec.ai | finished in 4h35m0s |
| 2026-09-01 07:06 UTC | selftests: nci: Fix uninitialized family ID on missing attribute | 1 | nagachaithanya9911@gmail.com | finished in 2h29m0s |
| 2026-08-26 07:57 UTC | nfc: llcp: Fix race condition in accept_queue lifecycle | 2 | lee@kernel.org |
finished
in 1h59m0s
[1 findings] |
| 2026-08-21 14:13 UTC | nfc: llcp: fix UAF on socket in nfc_llcp_tx_work() | 1 | edumazet@google.com | finished in 4h26m0s |
| 2026-08-21 10:32 UTC | nfc: llcp: fix NULL pointer dereference race in nfc_llcp_send_ui_frame() | 2 | jdoh.kernel@gmail.com | finished in 4h10m0s |
| 2026-08-20 20:56 UTC | nfc: st-nci: Fairphone 5 NFC bring-up (ST21NFCD) | 3 | isyourbrainfoss@proton.me | finished in 1h48m0s |
| 2026-08-19 21:09 UTC | nfc: st-nci: Fairphone 5 NFC bring-up (ST21NFCD) | 2 | isyourbrainfoss@proton.me | skipped |
| 2026-08-17 18:46 UTC | selftests: nci: Fix wrong size of status variables in nci_dev test | 2 | thuth@redhat.com | skipped |
| 2026-08-12 09:24 UTC | nfc: nci: fix use of uninitialized memory in NFC-DEP general bytes | 4 | meatuni001@gmail.com | finished in 4h27m0s |
| 2026-08-12 07:38 UTC | nfc: nci: Fix conn_info use-after-free | 5 | sanghyun.park.cnu@gmail.com | finished in 4h3m0s |
| 2026-08-11 22:01 UTC | nfc: s3fwrn5: support the S3NRN4V variant | 5 | jorijnvdgraaf@catcrafts.net | finished in 1h56m0s |
| 2026-08-07 16:28 UTC | net/nfc: Fix Use-After-Free in nfc_llcp_general_bytes() | 1 | weir@nebusec.ai | finished in 4h55m0s |
| 2026-08-07 02:09 UTC | nfc: s3fwrn5: support the S3NRN4V variant | 4 | jorijnvdgraaf@catcrafts.net | skipped |
| 2026-08-01 05:10 UTC | nfc: trf7970a: fix lifetime ordering around IRQ setup and teardown | 3 | fanwu01@zju.edu.cn | finished in 2h7m0s |
| 2026-07-31 02:43 UTC | nfc: st-nci: drain SE timers before NCI teardown | 2 | fanwu01@zju.edu.cn | finished in 4h39m0s |
| 2026-07-29 07:24 UTC | selftests: nci: Correct pthread_create return value check | 2 | zhulei_szu@163.com | skipped |
| 2026-07-29 01:15 UTC | nfc: nci: fix u8 underflow in nci_store_general_bytes_nfc_dep | 1 | snowwlake@icloud.com | finished in 2h35m0s |
| 2026-07-28 13:28 UTC | nfc: nci: fix use of uninitialized memory in NFC-DEP general bytes | 3 | meatuni001@gmail.com | finished in 5h12m0s |
| 2026-07-28 03:10 UTC | nfc: trf7970a: initialize lock and timeout_work before requesting the IRQ | 1 | fanwu01@zju.edu.cn | skipped |
| 2026-07-28 03:07 UTC | nfc: trf7970a: drain timeout_work and keep trf->lock valid across teardown | 2 | fanwu01@zju.edu.cn | skipped |
| 2026-07-27 03:15 UTC | selftests: nci: Correct pthread_create return value check | 1 | zhulei_szu@163.com | skipped |
| 2026-07-26 22:24 UTC | nfc: s3fwrn5: support the S3NRN4V variant | 3 | jorijnvdgraaf@catcrafts.net | finished in 2h54m0s |
| 2026-07-25 11:55 UTC | nfc: llcp: fix NULL pointer dereference race in nfc_llcp_send_ui_frame() | 1 | jdoh.kernel@gmail.com | finished in 5h17m0s |
| 2026-07-24 11:22 UTC | nfc: fdp: bound the device-reported read length and fix an skb leak | 3 | devnull@kernel.org | finished in 3h6m0s |
| 2026-07-23 17:44 UTC | nfc: digital: fix use-after-free in nfc_digital_unregister_device() | 2 | bestswngs@gmail.com | skipped |
| 2026-07-23 02:24 UTC | nfc: nci: Fix conn_info use-after-free | 4 | sanghyun.park.cnu@gmail.com | finished in 5h30m0s |
| 2026-07-21 20:55 UTC | MAINTAINERS: add nci tests to nfc | 1 | kuba@kernel.org | skipped |
| 2026-07-21 16:36 UTC | nfc: digital: fix use-after-free in nfc_digital_unregister_device() | 1 | bestswngs@gmail.com | finished in 1h56m0s |
| 2026-07-21 02:35 UTC | nfc: nci: free destination parameters when closing a connection | 1 | lilinmao@kylinos.cn | finished in 2h10m0s |
| 2026-07-20 19:37 UTC | nfc: llcp: Fix nfc_dev refcount leak in connect | 2 | shuangpeng.kernel@gmail.com | finished in 5h42m0s |
| 2026-07-20 10:13 UTC | MAINTAINERS: Add Matrix channel to the NFC subsystem | 1 | devnull@kernel.org | skipped |
| 2026-07-16 23:26 UTC | nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() | 1 | qwe.aldo@gmail.com | finished in 5h22m0s |
| 2026-07-16 20:35 UTC | nfc: fix remaining OOB bugs in NCI/LLCP parsing | 5 | snowwlake@icloud.com | finished in 2h34m0s |
| 2026-07-16 03:16 UTC | NFC: trf7970a: Remove redundant dev_err() | 1 | panchuang@vivo.com | skipped |
| 2026-07-14 16:46 UTC | nfc: llcp: reject PDUs shorter than the LLCP header | 3 | doruk@0sec.ai | finished in 5h7m0s |
| 2026-07-13 21:59 UTC | nfc: microread: validate CARD_FOUND event length before parsing targets | 1 | doruk@0sec.ai | finished in 1h55m0s |