CVE-2024-38381 – This vulnerability in the Linux kernel's NFC (N... (How to Fix)

Q: What is the severity of CVE-2024-38381?

CVE-2024-38381 has a CVSS score of 7.1 (HIGH). This vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem allows uninitialized memory access when processing received packets. Attackers could potentially exploit this to cause kernel crashes or leak sensitive kernel memory. Systems using NFC functionality in affected Linux kernel versions are vulnerable.

📋 TL;DR

This vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem allows uninitialized memory access when processing received packets. Attackers could potentially exploit this to cause kernel crashes or leak sensitive kernel memory. Systems using NFC functionality in affected Linux kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Affected versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with NFC functionality enabled/used. Many servers may not have NFC hardware or drivers loaded.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, potential information disclosure of kernel memory, or local privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System instability, kernel crashes (denial of service), or information leakage from kernel memory.

🟢

If Mitigated

Minimal impact if NFC functionality is disabled or unused, or if proper packet validation is implemented.

🌐 Internet-Facing: LOW - NFC typically requires physical proximity or local network access.

🏢 Internal Only: MEDIUM - Requires local access or NFC proximity, but could be exploited by malicious insiders or compromised internal devices.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to send malformed NFC packets to the system, typically needing physical proximity or local network access to NFC interfaces.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 017ff397624930fd7ac7f1761f3c9d6a7100f68c, 406cfac9debd4a6d3dc5d9258ee086372a8c08b6, 485ded868ed62ceb2acb3a459d7843fd71472619, ad4d196d2008c7f413167f0a693feb4f0439d7fe, e4a87abf588536d1cdfb128595e6e680af5cf3ed

Vendor Advisory: https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable NFC kernel module

linux

Prevent loading of NFC drivers if not needed

echo 'blacklist nci' >> /etc/modprobe.d/blacklist-nci.conf
rmmod nci 2>/dev/null || true

Restrict NFC device access

linux

Limit which users can access NFC devices

chmod 600 /dev/nfc* 2>/dev/null || true
setfacl -m u:root:rw- /dev/nfc* 2>/dev/null || true

🧯 If You Can't Patch

Disable all NFC hardware and unload NFC kernel modules
Implement network segmentation to isolate systems with NFC functionality

🔍 How to Verify

Check if Vulnerable:

Check if NFC modules are loaded: lsmod | grep -i nci && echo 'Potentially vulnerable if kernel not patched'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against distribution's security advisories and verify NFC functionality still works properly

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages mentioning nci_rx_work
System crashes when NFC is in use
dmesg warnings about uninitialized memory access

Network Indicators:

Unusual NFC packet patterns if monitored
Multiple malformed NFC connection attempts

SIEM Query:

source="kernel" AND ("nci" OR "NFC") AND ("panic" OR "oops" OR "uninitialized")

📊 Metadata

CVE ID: CVE-2024-38381

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-908

Published: June 21, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-38381, you might also want to check these: