CVE-2026-80800
Received Received - Intake

Buffer Overflow in Linux Kernel NFC LLCP

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connect_sn TLV walk to the skb Commit 27256cdb290e ("nfc: llcp: bound SNL TLV parsing to the skb and add length checks") fixed the unbounded TLV walk in nfc_llcp_recv_snl(), and commit d8bd2dedbde5 ("nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers") subsequently bounded nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv(). One sibling parser sharing the same pattern remains unbounded: nfc_llcp_connect_sn(). nfc_llcp_connect_sn() walks a TLV list, reading a two-byte header (type, length) followed by length bytes of value, without checking that the two header bytes or the declared length stay within the buffer. It returns a pointer to a service name of up to 255 bytes that may point past the end of the skb; it is subsequently consumed by memcmp() in nfc_llcp_sock_from_sn(). In addition tlv_array_len was computed as "skb->len - LLCP_HEADER_SIZE" in size_t, so a CONNECT/CC frame shorter than the LLCP header underflows to a huge length and the walk runs far past the buffer. nfc_llcp_connect_sn() is reachable from nfc_llcp_recv_connect() and nfc_llcp_recv_cc(), i.e. from received CONNECT and CC PDUs. A nearby NFC device can reach this without authentication; LLCP link activation happens automatically after NFC-DEP, and the nfc_llcp_rx_skb() dispatcher applies no minimum-length guard. Walk the TLV list by pointer, bounded by skb_tail_pointer(skb), and validate each declared length before use, matching the approach already used for nfc_llcp_recv_snl(). Starting the walk at &skb->data[LLCP_HEADER_SIZE] against the tail pointer also removes the size_t underflow for short frames. Found by 0sec automated security-research tooling (https://0sec.ai).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80800
EUVD
EUVD-2026-71235

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's NFC (Near Field Communication) LLCP (Logical Link Control Protocol) module. It involves an unbounded TLV (Type-Length-Value) parser in the nfc_llcp_connect_sn() function that can read past the end of a received network packet buffer. The issue occurs because the function does not properly validate the length of TLV entries or ensure they stay within the packet's bounds. This can lead to out-of-bounds memory reads.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFC LLCP implementation and requires kernel-level inspection. Detection involves checking kernel logs for crashes or unusual behavior related to NFC operations. Commands like 'dmesg | grep -i nfc' or 'journalctl -k | grep -i nfc' may show errors. No direct network commands detect this as it requires physical NFC proximity.

Impact Analysis

An attacker within NFC range could exploit this to cause a denial of service by crashing the system or potentially execute arbitrary code with kernel privileges. Since NFC devices can communicate without authentication after link activation, this vulnerability may be remotely exploitable by nearby attackers.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Disable NFC functionality if not required by unloading the NFC kernel modules with 'modprobe -r nfc'. Monitor vendor advisories for updates. Ensure NFC devices are not left in discoverable mode to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80800. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart