CVE-2026-80795
Received Received - Intake

Heap-based Buffer Overflow in Linux Kernel NFC NCI Subsystem

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in nci_target_auto_activated() nci_target_auto_activated() appends a target to the fixed-size array ndev->targets[NCI_MAX_DISCOVERED_TARGETS] and increments ndev->n_targets without first checking the array is full; unlike its sibling nci_add_new_target(), which bails out when n_targets already equals NCI_MAX_DISCOVERED_TARGETS. ndev->n_targets is only cleared by nci_clear_target_list(), so an NFCC that repeatedly re-runs discovery (RF_DISCOVER_RSP, which re-enters NCI_DISCOVERY without clearing the target list) and reports an auto-activated target (RF_INTF_ACTIVATED_NTF) drives n_targets past the limit. The append then writes a struct nfc_target past the end of the array (a slab out-of-bounds write), and nfc_targets_found() goes on to walk the array with the inflated count: BUG: KASAN: slab-out-of-bounds in nci_add_new_protocol+0x94/0x2ac [nci] Write of size 2 at addr ffff0000c7299a18 by task kworker/u8:0/12 Workqueue: nfc0_nci_rx_wq nci_rx_work [nci] Call trace: nci_add_new_protocol+0x94/0x2ac [nci] nci_ntf_packet+0xddc/0x11a0 [nci] nci_rx_work+0x15c/0x1e0 [nci] process_one_work+0x2dc/0x500 worker_thread+0x240/0x460 kthread+0x1c0/0x1d0 ret_from_fork+0x10/0x20 The buggy address belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1024 bytes to the right of allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618) Guard nci_target_auto_activated() with the same check used by nci_add_new_target().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80795
EUVD
EUVD-2026-71438

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a function called nci_target_auto_activated() writes past the end of a fixed-size array. The function adds targets to an array without checking if it is full, causing a slab out-of-bounds write when the array limit is exceeded. This happens when an NFC controller repeatedly runs discovery and reports auto-activated targets.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFC subsystem and may not have direct network detection methods. Monitor kernel logs for slab out-of-bounds errors or crashes related to nci_target_auto_activated. Check for repeated RF_DISCOVER_RSP and RF_INTF_ACTIVATED_NTF events in NFC logs.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It may also enable denial-of-service attacks by destabilizing the system.

Compliance Impact

This vulnerability is a memory corruption issue in the Linux kernel's NFC subsystem that could lead to system instability or crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel memory safety. However, if exploited, it could potentially compromise system integrity, indirectly impacting security posture relevant to compliance.

Mitigation Strategies

Apply the kernel patch that adds bounds checking in nci_target_auto_activated(). Update to a Linux kernel version containing the fix. If immediate patching is not possible, disable NFC functionality or restrict access to NFC interfaces until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart