Sam Morgan was attacked at Lighthouse Beach in East Ballina on Tuesday evening but managed to make it back to the beach, where others came to his aid.
The 20-year-old suffered serious wounds to his left thigh and was flown to the Gold Coast University Hospital where he underwent surgery on Tuesday night.
He remains in a stable condition in an induced coma.
The Department of Primary Industries believes the shark was possibly a bull shark around 2.8 to 3.1 metres long.
At least 14 shark attacks have been recorded in NSW this year, including a serious attack on bodyboarder Mat Lee in July at the same beach and a fatality nearby, when Japanese surfer Tadashi Nakahara, 41, was killed at Shelly Beach on February 9.
Police have closed Lighthouse Beach for 24 hours and have been investigating the attack.
- AAP