ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
ZDI Published Advisoriespublished ()ingested

ZDI-26-685: Linux Kernel NFC NCI UART Driver Race Condition Local Privilege Escalation Vulnerability

highVulnerabilityimportance 38CVE-2025-38416
AI summary · glm-5.3

ZDI discloses a race condition in the Linux kernel NFC NCI UART driver (CVE-2025-38416, CVSS 8.8) allowing local low-privileged attackers to escalate privileges.

ZDI advisory ZDI-26-685 covers a race condition vulnerability in the Linux kernel's NFC NCI UART driver, tracked as CVE-2025-38416 with a CVSS score of 8.8. A local attacker with the ability to execute low-privileged code can exploit the race to escalate privileges on affected systems. Exposure is limited to systems where the NFC NCI UART driver is present, and no exploitation is reported.

  • Race condition in Linux kernel NFC NCI UART driver, CVE-2025-38416, CVSS 8.8
  • Requires prior local low-privileged code execution to exploit
  • Only affects systems with the NFC NCI UART driver loaded
  • No indication of in-the-wild exploitation in the advisory
Read the original
Tagslinuxkernelnfcrace-conditionprivilege-escalationzdicve

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2025-38416
In the Linux kernel, the following vulnerability has been resolved:

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty->disc_data only in success path Setting tty->disc_data before opening the NCI device means we need to clean it up on error paths. This also opens some short window if device starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded (broken hardware?). Close the window by exposing tty->disc_data only on the success path, when opening of the NCI device and try_module_get() succeeds. The code differs in error path in one aspect: tty->disc_data won't be ever assigned thus NULL-ified. This however should not be relevant difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().

NVD description · AI analysis pending		7.8<1%
  • linux linux kernel
  • linux debian linux
—
Full article

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-38416.

This source does not provide full text. Read it at zerodayinitiative.com.