CVE-2026-63915
Received Received - Intake

Heap Buffer Overflow in Linux Kernel NFC HCI Layer

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read packet->header from skb->data at function entry without first checking that the buffer holds at least one byte. A malicious NFC peer can send a 0-byte HCP frame that passes through the SHDLC layer and reaches these functions, causing an out-of-bounds heap read of packet->header. The same 0-byte frame, if queued as a non-final fragment, also causes the reassembly loop to underflow msg_len to UINT_MAX, triggering skb_over_panic() when the reassembled skb is written. Fix this by adding a pskb_may_pull() check at the entry of each function before packet->header is first accessed. The existing pskb_may_pull() checks before the reassembled hcp_skb is cast to struct hcp_packet remain in place to guard the 2-byte HCP message header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63915
EUVD
EUVD-2026-45688

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's NFC (Near Field Communication) HCI (Host Controller Interface) implementation. It involves an out-of-bounds read issue in the HCP (Host Controller Protocol) header parsing functions. The problem occurs when functions like nfc_hci_recv_from_llc() and nci_hci_data_received_cb() access packet->header from skb->data without first verifying the buffer has at least one byte. A malicious NFC peer can send a 0-byte HCP frame that bypasses the SHDLC layer and triggers this flaw, causing a heap read out of bounds.

Detection Guidance

This vulnerability involves out-of-bounds reads in NFC HCI parsing due to missing buffer checks. Detection requires monitoring kernel logs for skb_over_panic errors or unusual NFC-related crashes. Check dmesg for kernel oops related to NFC or HCI modules.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or potentially execute arbitrary code with kernel privileges by sending a specially crafted 0-byte NFC frame. It may also lead to denial-of-service conditions if the system panics due to skb_over_panic() when processing malformed frames.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel issue involving out-of-bounds memory access in NFC HCI packet parsing, which could lead to system crashes or potential information exposure. Compliance impacts would depend on how the affected system is used and whether such failures could lead to unauthorized data access or processing violations.

Mitigation Strategies

Apply the Linux kernel patch that adds pskb_may_pull() checks before accessing packet headers in nfc_hci_recv_from_llc() and nci_hci_data_received_cb(). Update to a fixed kernel version. If patching is not immediately possible, disable NFC functionality or restrict NFC peer connections as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart