Re: Path forward for NFC in the kernel

Mark Greer
2026-04-20T15:31:55Z

[Trying this again hopefully without HTML.]

On 4/17/26 12:18 AM, Krzysztof Kozlowski wrote:
> On 16/04/2026 19:10, Jakub Kicinski wrote:
>> Hi folks! We are struggling to keep up with the number of security
>> reports and AI generated patches in the kernel. NFC is infamous for
>> being a huge CVE magnet. We need someone to step up as a maintainer,
>> create an NFC tree and handle all the incoming submissions. Send us
>> (or Linus if you prefer) periodic PRs, like WiFi, Bluetooth etc. do.
>> If that does not happen I'm afraid we'll have to move the NFC code
>> out of the tree, put it up on GH or some such, and let it accumulate
>> CVEs there.. I'm planning to send a PR to Linus to shed the
>> unmaintained code early next week. We need to have a maintainer
>> established by then.
> +Cc David Heidelberg recently trying to use Linux NFC stack, Just
> "collecting" patches is not a big deal, I could do this, but actually
> reviewing the patches with necessary due diligence is the effort I
> could not provide in a reasonable time frame. And picking up patches
> without proper review feels risky... NFC has a long history of issues,
> first mostly pointed out by syzbot but now apparently by AI tools. The
> code base is quite old, with no major improvements or testings
> happening but not in a way "oh, it's stable and working like 'cp'
> command" but rather "no one knows how many bugs are on top of each
> other and if it actually still works". Syzbot and AI reported bugs
> encourage random drive-by fixes by people not testing the code, thus
> particular bug report might be fixed, but for example NFC stops
> working and no one knows that. Does anyone knows if the NFC
> stack/drivers actually works fine? Did anyone test actual devices? If
> not, then moving to Github would be even more reasonable. Another
> point is that AFAIU, most of real world devices, like Android-based
> phones, don't use the Linux NFC stack but their custom HAL/user-space
> based libraries and drivers. Some other non-Android projects use
> libnfc userspace, which seems to be maintained only as bugfix
> (https://github.com/nfc-tools/libnfc/commits/master/). Best regards,
> Krzysztof

That is my understanding too.

I would love to take this on but I've been swamped for years with my
"day job" and I'm pretty burned out.
Taking on something like this isn't possible for me. I also didn't
realize it was creating so many CVEs so,
yeah, sounds like it should be removed then. Thanks for all of the work
you did on this, Krzysztof.

Mark
--