CVE-2026-80796
Received Received - Intake

Buffer Overflow in Linux Kernel NFC NCI Module

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add data_len bound checks to activation parameter extractors nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() read an inner length byte from the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed kernel buffers, but neither function receives the caller-validated activation_params_len. A crafted NCI notification with activation_params_len=1 and an inner length byte of up to 20 (NFC-A) or 50 (NFC-B) causes memcpy() to read that many bytes past the one valid byte in the activation params region -- a slab out-of-bounds read of kernel memory adjacent to the NCI skb. The sibling nci_extract_rf_params_*() family was given equivalent protection by commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter validation for packet data"), but the two activation parameter extractors were not updated at that time. Add a data_len parameter to both functions, guard against an empty region before consuming the inner length byte, decrement the remaining count after consuming it, and clamp the copy length to what is actually available. Update both call sites to pass ntf.activation_params_len, which is already validated against the skb at ntf.c:801.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80796
EUVD
EUVD-2026-71439

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's NFC (Near Field Communication) NCI (NFC Controller Interface) implementation. It involves two functions, nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep(), which read an inner length byte from an NCI RF_INTF_ACTIVATED_NTF payload and use it to copy data into fixed kernel buffers. The issue is that these functions do not receive the caller-validated activation_params_len, allowing a crafted notification to cause a slab out-of-bounds read of kernel memory.

Detection Guidance

This vulnerability involves a memory corruption issue in the Linux kernel's NFC subsystem. Detection requires checking kernel logs for NCI-related errors or crashes, particularly during NFC device activation. Monitor for slab out-of-bounds errors or kernel panics related to nci_extract_activation_params_iso_dep or nci_extract_activation_params_nfc_dep functions.

Impact Analysis

This vulnerability could allow an attacker to read sensitive kernel memory adjacent to the NCI skb buffer. This may lead to information disclosure, privilege escalation, or system instability if exploited. Attackers could potentially access confidential data or cause denial-of-service conditions.

Compliance Impact

This vulnerability involves a slab out-of-bounds read in the Linux kernel's NFC subsystem, which could potentially expose sensitive kernel memory. While the description does not explicitly link this to compliance standards, such memory exposure risks could impact data confidentiality, a key requirement under GDPR and HIPAA. However, specific compliance implications depend on system configuration and deployment context.

Mitigation Strategies

Apply the Linux kernel patch that adds data_len bound checks to the activation parameter extractors. Update to a kernel version that includes the fix from commit 571dcbeb8e63 or later. If immediate patching is not possible, disable NFC functionality or restrict access to NFC devices until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80796. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart