CVE-2023-53119: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2023-53119) was discovered in the Linux kernel's NFC subsystem, specifically in the PN533 driver. The issue was identified by the Linux Verification Center using Syzkaller and was published on May 2, 2025. The vulnerability affects Linux systems with the PN533 NFC driver enabled (NVD, Wiz).

The vulnerability stems from improper initialization of the struct pn533_out_arg used as a temporary context for out_urb. Specifically, the uninitialized 'phy' field can be dereferenced in error cases inside the pn533_out_complete() callback function at drivers/nfc/pn533/usb.c:441. The issue manifests as a null-pointer dereference in the address range [0x0000000000000000-0x0000000000000007]. Red Hat has assigned this vulnerability a CVSS score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD, Red Hat).

When triggered, the vulnerability results in a general protection fault with a non-canonical address 0xdffffc0000000000, which can lead to system instability or crashes on affected systems (Wiz).

The vulnerability has been fixed by properly initializing the 'phy' field with the pn533_usb_phy currently in use. Fixed versions are available in various Linux distributions, including Debian bullseye (5.10.234-1) and bookworm (6.1.135-1) (Debian Security).