CVE-2026-80794
Received Received - Intake

Uninitialized Memory Exposure in Linux Kernel NFC NCI

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() each parse a notification into an on-stack struct (nci_rf_discover_ntf / nci_rf_intf_activated_ntf) that is not initialised. The RF technology-specific parameters are only extracted when rf_tech_specific_params_len is non-zero, so a notification that reports a zero length leaves the rf_tech_specific_params union uninitialised - and both handlers then pass it to nci_add_new_protocol(), which reads it: - discover: nci_add_new_target() -> nci_add_new_protocol(); - activated: nci_target_auto_activated() -> nci_add_new_protocol(). nci_add_new_protocol() uses nfca_poll->nfcid1_len as both a branch condition and a memcpy() length and copies nfcid1/sens_res/sel_res into ndev->targets, which is later exposed to user space via NFC_CMD_GET_TARGET. BUG: KMSAN: uninit-value in nci_add_new_protocol+0x624/0x6c0 nci_add_new_protocol+0x624/0x6c0 nci_ntf_packet+0x25b2/0x3c30 nci_rx_work+0x318/0x5d0 process_scheduled_works+0x84b/0x17a0 worker_thread+0xc10/0x11b0 kthread+0x376/0x500 Local variable ntf.i created at: nci_ntf_packet+0xbc2/0x3c30 Zero-initialise both on-stack notifications so the union reads back as zero when no technology-specific parameters are present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80794
EUVD
EUVD-2026-71437

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where uninitialized memory is used in NFC (Near Field Communication) notification handlers. The issue occurs in nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() functions when processing RF discover or activated notifications. These functions parse notifications into on-stack structures that are not fully initialized, leading to potential exposure of uninitialized data to user space via NFC_CMD_GET_TARGET.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFC subsystem and may not have direct network detection commands. However, you can check if your system is running a vulnerable kernel version using: uname -a. If your kernel version is below the patched version, it may be vulnerable.

Impact Analysis

This vulnerability could allow an attacker to read uninitialized kernel memory, potentially exposing sensitive information such as cryptographic keys, passwords, or other confidential data. Since the uninitialized data is exposed through NFC_CMD_GET_TARGET, it may be accessible to local users or processes with NFC device access.

Compliance Impact

This vulnerability involves uninitialized memory being exposed to user space via NFC_CMD_GET_TARGET, which could potentially leak sensitive data. For compliance with standards like GDPR or HIPAA, such data exposure risks violating confidentiality requirements if exploited.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate patching is not possible, consider disabling the NFC subsystem if not in use by blacklisting the nci module: echo 'blacklist nci' | sudo tee /etc/modprobe.d/disable-nci.conf && sudo update-initramfs -u.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80794. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart