CVE-2026-80799
Received Received - Intake

Buffer Overflow in Linux Kernel NFC LLCP

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data advances offset past 255 it silently wraps to zero, causing infinite loops or double-processing of buffer data. 2. Before reading tlv[0] (type) and tlv[1] (length) there is no check that offset+2 <= tlv_array_len. A truncated TLV causes an OOB read of one byte past the buffer end. 3. After reading the length field, the value bytes are accessed without checking offset+2+length <= tlv_array_len. A crafted length=0xFF on a short buffer causes up to 255 bytes of OOB read past the buffer end. Both functions are reachable without authentication via nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes directly into nfc_llcp_parse_gb_tlv() with no additional validation. Fix all three issues by widening offset from u8 to u16 and adding bounds checks for both the TLV header and value field before each access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80799
EUVD
EUVD-2026-71234

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's NFC LLCP (Near Field Communication Logical Link Control Protocol) component. It involves three bugs in TLV (Type-Length-Value) parsing functions: an 8-bit offset variable that can wrap around causing infinite loops, missing bounds checks leading to out-of-bounds reads, and unchecked value field access that allows reading up to 255 extra bytes past the buffer. These issues can be triggered remotely without authentication via crafted LLCP general bytes.

Detection Guidance

This vulnerability affects the Linux kernel's NFC LLCP TLV parsing. Detection requires checking kernel versions and examining NFC-related logs or traffic. Use uname -a to check kernel version and dmesg | grep -i nfc to inspect NFC subsystem logs for errors or crashes.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service through kernel crashes or memory corruption. It might also enable information disclosure by reading sensitive kernel memory. Since it can be triggered remotely without authentication, any system using the affected Linux kernel with NFC LLCP functionality could be at risk.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that fixes CVE-2026-80799. Disable the NFC LLCP subsystem if not needed using kernel parameters or module blacklisting. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart