CVE-2026-80798
Received Received - Intake

Buffer Overflow in Linux Kernel NFC LLCP

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the receive path never checked that a frame is at least LLCP_HEADER_SIZE bytes before parsing it. nfc_llcp_rx_skb() reads the header via nfc_llcp_ptype()/nfc_llcp_dsap()/ nfc_llcp_ssap(), which dereference pdu->data[0] and pdu->data[1], and a CONNECT or CC PDU then computes tlv_array_len = skb->len - LLCP_HEADER_SIZE; as a size_t and hands it to the TLV walk. When the frame is shorter than the header the subtraction wraps to a huge value and the walk runs far past the buffer, an out-of-bounds read. A nearby NFC device can reach this without authentication; LLCP link activation happens automatically after NFC-DEP. Guard the common receive choke point __nfc_llcp_recv(), shared by both the target (nfc_llcp_data_received()) and initiator (nfc_llcp_recv()) paths, so a short skb is dropped before the rx_work worker parses it. Use pskb_may_pull() rather than a skb->len test so the two header bytes are guaranteed to sit in the skb linear area even for a non-linear skb, matching how the sibling NCI and HCI receive paths validate their headers. Reproduced with a KFENCE out-of-bounds read via /dev/virtual_nci on linux-next. Found by 0sec automated security-research tooling (https://0sec.ai).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80798
EUVD
EUVD-2026-71441

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's NFC LLCP (Near Field Communication Logical Link Control Protocol) implementation. It involves a failure to validate that incoming LLCP PDUs (Protocol Data Units) are at least as long as the required two-byte header. When a maliciously short PDU is received, the kernel attempts to parse it, leading to an out-of-bounds read as the code incorrectly calculates a large buffer size due to integer underflow.

Detection Guidance

This vulnerability affects the Linux kernel's NFC LLCP implementation. Detection requires checking kernel logs for out-of-bounds read errors or monitoring for malformed NFC frames. Use 'dmesg | grep -i nfc' to inspect kernel logs for NFC-related errors. If you suspect exploitation, check for unusual network traffic patterns involving NFC devices.

Impact Analysis

An attacker within NFC range could exploit this to trigger an out-of-bounds read in the Linux kernel, potentially causing system crashes, data corruption, or privilege escalation. Since NFC-DEP link activation happens automatically, no authentication is required for exploitation.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If immediate patching is not possible, disable NFC functionality by unloading the NFC kernel modules with 'modprobe -r nfc' or blacklisting them. Monitor for suspicious activity and restrict NFC device access to trusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart