CVE-2026-80802
Received Received - Intake

Buffer Overflow in Linux Kernel NFC FDP Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdp_nci_i2c_read() takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2c_master_recv() count into a 261-byte on-stack buffer: a malicious, counterfeit or malfunctioning controller (or an i2c bus interposer) can drive it far past the buffer for a stack out-of-bounds write that clobbers the canary and return address, or below the minimum frame size (directly, or by truncating the computed sum) so the header/LRC strip and the next length read run past a short receive. Reject a length outside [FDP_NCI_I2C_MIN_PAYLOAD, FDP_NCI_I2C_MAX_PAYLOAD], as a corrupted packet already is, and force resynchronization. The same loop allocates one data skb per iteration and assumes a length packet followed by a data packet; a device that sends two data packets in one call leaks the first skb when the second allocation overwrites it. Free a previously allocated skb before allocating the next.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80802
EUVD
EUVD-2026-71237

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's NFC (Near Field Communication) FDP (Felica Device Protocol) driver. It involves two issues: 1) A malicious device can provide an invalid read length that causes a stack buffer overflow, potentially leading to code execution or crashes. 2) A memory leak occurs when a device sends multiple data packets in one call, causing the kernel to lose track of allocated memory.

Detection Guidance

This vulnerability affects the Linux kernel's NFC FDP (Felica Device Protocol) driver. Detection requires checking if your system uses a vulnerable kernel version and inspecting NFC-related logs or traffic for malformed packets. No specific commands are provided in the context, but monitoring kernel logs for stack corruption errors or skb leaks in NFC operations may indicate exploitation.

Impact Analysis

If exploited, this flaw could allow an attacker with physical access to a device using the affected NFC driver to execute arbitrary code, crash the system, or cause denial-of-service conditions. It may also lead to memory exhaustion due to the skb leak.

Mitigation Strategies

Apply the latest kernel patches that fix the FDP driver vulnerability. If patches are unavailable, disable the NFC FDP driver by blacklisting the module or disabling NFC functionality until an update is applied. Monitor for unusual NFC device behavior or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart