CVE-2024-46676nfc: pn533: Add poll mod list filling check
- 5.5MediumCVSS base score
- 0.24%Exploitation in 30 daysEPSS · top 84% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Add poll mod list filling check In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Timeline
ID reserved
By Linux
- 2 days later
· 2 days later
Published
- 20 months later
· 20 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.24% · top 84% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected dfccd0f580445d176acea174175b3e6518cc91f7 – < c5e05237444f32f6cfe5d907603a232c77a08b31
- affected dfccd0f580445d176acea174175b3e6518cc91f7 – < 8ddaea033de051ed61b39f6b69ad54a411172b33
- affected dfccd0f580445d176acea174175b3e6518cc91f7 – < 7535db0624a2dede374c42040808ad9a9101d723
- affected dfccd0f580445d176acea174175b3e6518cc91f7 – < 7ecd3dd4f8eecd3309432156ccfe24768e009ec4
- affected dfccd0f580445d176acea174175b3e6518cc91f7 – < 56ad559cf6d87f250a8d203b555dfc3716afa946
- affected dfccd0f580445d176acea174175b3e6518cc91f7 – < 64513d0e546a1f19e390f7e5eba3872bfcbdacf5
- affected dfccd0f580445d176acea174175b3e6518cc91f7 – < febccb39255f9df35527b88c953b2e0deae50e53
- affected 3.12
- unaffected < 3.12
- unaffected 5.4.283 – ≤ 5.4.*
- unaffected 5.10.225 – ≤ 5.10.*
- unaffected 5.15.166 – ≤ 5.15.*
- unaffected 6.1.108 – ≤ 6.1.*
- unaffected 6.6.49 – ≤ 6.6.*
- unaffected 6.10.8 – ≤ 6.10.*
- unaffected 6.11 – ≤ *
References
References9
- https://git.kernel.org/stable/c/c5e05237444f32f6cfe5d907603a232c77a08b31 (opens in a new tab)
- https://git.kernel.org/stable/c/8ddaea033de051ed61b39f6b69ad54a411172b33 (opens in a new tab)
- https://git.kernel.org/stable/c/7535db0624a2dede374c42040808ad9a9101d723 (opens in a new tab)
- https://git.kernel.org/stable/c/7ecd3dd4f8eecd3309432156ccfe24768e009ec4 (opens in a new tab)
- https://git.kernel.org/stable/c/56ad559cf6d87f250a8d203b555dfc3716afa946 (opens in a new tab)
- https://git.kernel.org/stable/c/64513d0e546a1f19e390f7e5eba3872bfcbdacf5 (opens in a new tab)
- https://git.kernel.org/stable/c/febccb39255f9df35527b88c953b2e0deae50e53 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-41937 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-46676)Record last updated .