Path forward for NFC in the kernel
Subsystems (3)
Jakub Kicinski
maintainerHi folks!
We are struggling to keep up with the number of security reports and AI generated patches in the kernel. NFC is infamous for being a huge CVE magnet. We need someone to step up as a maintainer, create an NFC tree and handle all the incoming submissions. Send us (or Linus if you prefer) periodic PRs, like WiFi, Bluetooth etc. do. If that does not happen I'm afraid we'll have to move the NFC code out of the tree, put it up on GH or some such, and let it accumulate CVEs there..
I'm planning to send a PR to Linus to shed the unmaintained code early next week. We need to have a maintainer established by then.
Hi,
Quoted 10 lines · Jakub Kicinski
Hi folks!
We are struggling to keep up with the number of security reports and AI generated patches in the kernel. NFC is infamous for being a huge CVE magnet. We need someone to step up as a maintainer, create an NFC tree and handle all the incoming submissions. Send us (or Linus if you prefer) periodic PRs, like WiFi, Bluetooth etc. do. If that does not happen I'm afraid we'll have to move the NFC code out of the tree, put it up on GH or some such, and let it accumulate CVEs there..
Quoted 2 lines
I'm planning to send a PR to Linus to shed the unmaintained code early next week. We need to have a maintainer established by then.
Thanks for asking, but I'm busy renovating my house, sorry. I couldn't put much work into that. The former is already stressful enough :)
-michael
Quoted 10 lines · Jakub Kicinski
Hi folks!
We are struggling to keep up with the number of security reports and AI generated patches in the kernel. NFC is infamous for being a huge CVE magnet. We need someone to step up as a maintainer, create an NFC tree and handle all the incoming submissions. Send us (or Linus if you prefer) periodic PRs, like WiFi, Bluetooth etc. do. If that does not happen I'm afraid we'll have to move the NFC code out of the tree, put it up on GH or some such, and let it accumulate CVEs there..
Quoted 2 lines
I'm planning to send a PR to Linus to shed the unmaintained code early next week. We need to have a maintainer established by then.
+Cc David Heidelberg recently trying to use Linux NFC stack,
Just "collecting" patches is not a big deal, I could do this, but actually reviewing the patches with necessary due diligence is the effort I could not provide in a reasonable time frame. And picking up patches without proper review feels risky...
NFC has a long history of issues, first mostly pointed out by syzbot but now apparently by AI tools. The code base is quite old, with no major improvements or testings happening but not in a way "oh, it's stable and working like 'cp' command" but rather "no one knows how many bugs are on top of each other and if it actually still works".
Syzbot and AI reported bugs encourage random drive-by fixes by people not testing the code, thus particular bug report might be fixed, but for example NFC stops working and no one knows that.
Does anyone knows if the NFC stack/drivers actually works fine? Did anyone test actual devices?
If not, then moving to Github would be even more reasonable.
Another point is that AFAIU, most of real world devices, like Android-based phones, don't use the Linux NFC stack but their custom HAL/user-space based libraries and drivers. Some other non-Android projects use libnfc userspace, which seems to be maintained only as bugfix (https://github.com/nfc-tools/libnfc/commits/master/).
Best regards,
Krzysztof
David Heidelberg
maintainerQuoted 14 lines · Krzysztof Kozlowski
Quoted 10 lines · Jakub Kicinski
Hi folks!
We are struggling to keep up with the number of security reports and AI generated patches in the kernel. NFC is infamous for being a huge CVE magnet. We need someone to step up as a maintainer, create an NFC tree and handle all the incoming submissions. Send us (or Linus if you prefer) periodic PRs, like WiFi, Bluetooth etc. do. If that does not happen I'm afraid we'll have to move the NFC code out of the tree, put it up on GH or some such, and let it accumulate CVEs there..
Quoted 2 lines
I'm planning to send a PR to Linus to shed the unmaintained code early next week. We need to have a maintainer established by then.
Quoted 6 lines
+Cc David Heidelberg recently trying to use Linux NFC stack,
Just "collecting" patches is not a big deal, I could do this, but actually reviewing the patches with necessary due diligence is the effort I could not provide in a reasonable time frame. And picking up patches without proper review feels risky...
Hello Krzystof, Jakub,
thanks for putting me into loop.
I can do limited reviews and basic maintenance. My knowledge about NFC is for now somehow limited (but I'm willing to invest my limited time into learning more).
As "I & LLM" wrote [1] userspace very basic reader for GNOME and planning to do more tight integration into GNOME, so would make sense to keep the kernel stack alive.
[1] https://gitlab.gnome.org/dh/gnfc/
Quoted 10 lines
NFC has a long history of issues, first mostly pointed out by syzbot but now apparently by AI tools. The code base is quite old, with no major improvements or testings happening but not in a way "oh, it's stable and working like 'cp' command" but rather "no one knows how many bugs are on top of each other and if it actually still works".
Syzbot and AI reported bugs encourage random drive-by fixes by people not testing the code, thus particular bug report might be fixed, but for example NFC stops working and no one knows that.
I think I could filter out nonsense, possibly with help of Sashiko [2].
Quoted 3 lines
Does anyone knows if the NFC stack/drivers actually works fine? Did anyone test actual devices?
Yes, nxp,pn553, nxp,pn557.
Other people did also test on some phones with different tags (I currently have only one tag with vCARD loaded on it).
David
Quoted 11 lines
If not, then moving to Github would be even more reasonable.
Another point is that AFAIU, most of real world devices, like Android-based phones, don't use the Linux NFC stack but their custom HAL/user-space based libraries and drivers. Some other non-Android projects use libnfc userspace, which seems to be maintained only as bugfix (https://github.com/nfc-tools/libnfc/commits/master/).
Best regards,
Krzysztof
Jakub Kicinski
maintainerQuoted 9 lines · On Fri, 17 Apr 2026 10:12:22 +0200 David Heidelberg wrote:
Quoted 6 lines
+Cc David Heidelberg recently trying to use Linux NFC stack,
Just "collecting" patches is not a big deal, I could do this, but actually reviewing the patches with necessary due diligence is the effort I could not provide in a reasonable time frame. And picking up patches without proper review feels risky...
Hello Krzystof, Jakub,
Quoted 8 lines
thanks for putting me into loop.
I can do limited reviews and basic maintenance. My knowledge about NFC is for now somehow limited (but I'm willing to invest my limited time into learning more).
As "I & LLM" wrote [1] userspace very basic reader for GNOME and planning to do more tight integration into GNOME, so would make sense to keep the kernel stack alive.
Hi David!
Sorry for the delay, we (core maintainers) discussed the situation off-list and since our choices are either delete all this code or give you a chance, everyone agreed that the latter is strictly better :) It's a little unusual to designate someone who doesn't have a proven track record acting as a de facto maintainer, but such are the times...
Our expectation would be that:
- you'd create your own tree to gather NFC patches and send us periodic pull requests every 2 or 3 weeks, with what you gathered
- act upon submissions within 48h of posting (excluding weekends)
Of course we'll happy to provide any support and guidance you need, specially for the first few months.
Is this what you had in mind? The phrase "limited reviews and basic maintenance" is slightly worrying, we assumed it's an expression of modesty rather than commitment? :)
David Heidelberg
maintainerQuoted 32 lines · Jakub Kicinski
Quoted 9 lines · On Fri, 17 Apr 2026 10:12:22 +0200 David Heidelberg wrote:
Quoted 6 lines
+Cc David Heidelberg recently trying to use Linux NFC stack,
Just "collecting" patches is not a big deal, I could do this, but actually reviewing the patches with necessary due diligence is the effort I could not provide in a reasonable time frame. And picking up patches without proper review feels risky...
Hello Krzystof, Jakub,
Quoted 8 lines
thanks for putting me into loop.
I can do limited reviews and basic maintenance. My knowledge about NFC is for now somehow limited (but I'm willing to invest my limited time into learning more).
As "I & LLM" wrote [1] userspace very basic reader for GNOME and planning to do more tight integration into GNOME, so would make sense to keep the kernel stack alive.
Hi David!
Sorry for the delay, we (core maintainers) discussed the situation off-list and since our choices are either delete all this code or give you a chance, everyone agreed that the latter is strictly better :) It's a little unusual to designate someone who doesn't have a proven track record acting as a de facto maintainer, but such are the times...
Our expectation would be that:
- you'd create your own tree to gather NFC patches and send us periodic pull requests every 2 or 3 weeks, with what you gathered
- act upon submissions within 48h of posting (excluding weekends)
Quoted 6 lines
Of course we'll happy to provide any support and guidance you need, specially for the first few months.
Is this what you had in mind? The phrase "limited reviews and basic maintenance" is slightly worrying, we assumed it's an expression of modesty rather than commitment? :)
Hi,
thanks for giving me the opportunity - I appreciate the trust, especially given the circumstances.
Yes, this is broadly in line with what I had in mind. To clarify the “limited reviews and basic maintenance” phrasing: that was more an attempt to set expectations conservatively. I’m prepared to take on the responsibilities you outlined — maintaining a tree, collecting and triaging patches, and sending regular pull requests.
Regarding reviews and responsiveness: I can do the 48h turnaround for initial feedback on submissions (excluding weekends, and occasional travel), and I’ll make sure no patch sits unattended. For more complex changes where my current NFC-specific knowledge may be a limiting factor, I’ll seek input rather than let things stall.
I’m also planning to ramp up my familiarity with the NFC stack as I go, so I expect both the quality and depth of my reviews to improve over time.
If that works for you, I’ll proceed with setting up a public tree and start tracking incoming patches.
Thanks again for the support - I’ll likely take you up on that, especially early on.
Best regards,
David
Jakub Kicinski
maintainerQuoted 11 lines · On Wed, 22 Apr 2026 15:11:16 +0200 David Heidelberg wrote:
Yes, this is broadly in line with what I had in mind. To clarify the “limited reviews and basic maintenance” phrasing: that was more an attempt to set expectations conservatively. I’m prepared to take on the responsibilities you outlined — maintaining a tree, collecting and triaging patches, and sending regular pull requests.
Regarding reviews and responsiveness: I can do the 48h turnaround for initial feedback on submissions (excluding weekends, and occasional travel), and I’ll make sure no patch sits unattended. For more complex changes where my current NFC-specific knowledge may be a limiting factor, I’ll seek input rather than let things stall.
Sounds good. The discussion taking long is perfectly fine. Main concern to us is not hearing any response for a long time. Then we have to guess whether the maintainer is planning to respond, or AWOL.
Quoted 5 lines
I’m also planning to ramp up my familiarity with the NFC stack as I go, so I expect both the quality and depth of my reviews to improve over time.
If that works for you, I’ll proceed with setting up a public tree and start tracking incoming patches.
Works! :)
Quoted 2 lines · Krzysztof Kozlowski
Does anyone knows if the NFC stack/drivers actually works fine? Did anyone test actual devices?
I was working on a product which used an NFC part from NXP. We started with the upstream driver and libnfc and we did some bugfixes, that's also probably the reason I'm in the loop here ;).
But eventually it was decided to switch to the libs provided by the vendor, because that at least somehow worked reliably (and you'll get support from the vendor).
-michael
David Heidelberg
maintainerQuoted 11 lines · Michael Walle
Quoted 2 lines · Krzysztof Kozlowski
Does anyone knows if the NFC stack/drivers actually works fine? Did anyone test actual devices?
I was working on a product which used an NFC part from NXP. We started with the upstream driver and libnfc and we did some bugfixes, that's also probably the reason I'm in the loop here ;).
But eventually it was decided to switch to the libs provided by the vendor, because that at least somehow worked reliably (and you'll get support from the vendor).
So what we need is show vendor how wonderful Linux kernel is, thus he should contribute to it and then switch to it (when nVidia can understand it's beneficial to them, why not NXP).
David
Quoted 2 lines
-michael
Signature · 1 line
David Heidelberg
David Heidelberg
maintainerQuoted 11 lines · Krzysztof Kozlowski
Quoted 10 lines · Jakub Kicinski
Hi folks!
We are struggling to keep up with the number of security reports and AI generated patches in the kernel. NFC is infamous for being a huge CVE magnet. We need someone to step up as a maintainer, create an NFC tree and handle all the incoming submissions. Send us (or Linus if you prefer) periodic PRs, like WiFi, Bluetooth etc. do. If that does not happen I'm afraid we'll have to move the NFC code out of the tree, put it up on GH or some such, and let it accumulate CVEs there..
Quoted 5 lines
Quoted 2 lines
I'm planning to send a PR to Linus to shed the unmaintained code early next week. We need to have a maintainer established by then.
+Cc David Heidelberg recently trying to use Linux NFC stack,
For now we had NFC related discussion in our sdm845-next channel, but I brought Matrix channel [1] for the kernel, neard, user-space discussion, so people can share and interact in real-time (the chat content is public without needing to join the room).
David
[1] https://matrix.to/#/#linux-nfc:ixit.cz
...
[Trying this again hopefully without HTML.]
Quoted 4 lines · Krzysztof Kozlowski
Quoted 1 line · Jakub Kicinski
Hi folks! We are struggling to keep up with the number of security reports and AI generated patches in the kernel. NFC is infamous for being a huge CVE magnet. We need someone to step up as a maintainer, create an NFC tree and handle all the incoming submissions. Send us (or Linus if you prefer) periodic PRs, like WiFi, Bluetooth etc. do. If that does not happen I'm afraid we'll have to move the NFC code out of the tree, put it up on GH or some such, and let it accumulate CVEs there.. I'm planning to send a PR to Linus to shed the unmaintained code early next week. We need to have a maintainer established by then.
+Cc David Heidelberg recently trying to use Linux NFC stack, Just
"collecting" patches is not a big deal, I could do this, but actually reviewing the patches with necessary due diligence is the effort I could not provide in a reasonable time frame. And picking up patches without proper review feels risky... NFC has a long history of issues, first mostly pointed out by syzbot but now apparently by AI tools. The code base is quite old, with no major improvements or testings happening but not in a way "oh, it's stable and working like 'cp' command" but rather "no one knows how many bugs are on top of each other and if it actually still works". Syzbot and AI reported bugs encourage random drive-by fixes by people not testing the code, thus particular bug report might be fixed, but for example NFC stops working and no one knows that. Does anyone knows if the NFC stack/drivers actually works fine? Did anyone test actual devices? If not, then moving to Github would be even more reasonable. Another point is that AFAIU, most of real world devices, like Android-based phones, don't use the Linux NFC stack but their custom HAL/user-space based libraries and drivers. Some other non-Android projects use libnfc userspace, which seems to be maintained only as bugfix (https://github.com/nfc-tools/libnfc/commits/master/). Best regards, Krzysztof
That is my understanding too.
I would love to take this on but I've been swamped for years with my "day job" and I'm pretty burned out. Taking on something like this isn't possible for me. I also didn't realize it was creating so many CVEs so, yeah, sounds like it should be removed then. Thanks for all of the work you did on this, Krzysztof.
Mark