CVE-2026-80803
Received Received - Intake

Buffer Overflow in Linux Kernel NFC Digital Layer

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target. Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy. Found by 0sec automated security-research tooling (https://0sec.ai).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80803
EUVD
EUVD-2026-71238

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the Linux kernel's NFC (Near Field Communication) subsystem. It occurs in the digital_in_recv_sensf_res() function when handling NFC-F device responses. The function copies data from a remote device into a fixed-size buffer without checking if the data exceeds the buffer's capacity, potentially allowing a nearby malicious NFC-F device to overflow the stack.

Detection Guidance

This vulnerability involves an NFC stack overflow in the Linux kernel. Detection requires checking if your system runs a vulnerable kernel version. Use uname -a to check the kernel version. If the version is below the patched release, the system is likely vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system with kernel privileges. This could lead to system crashes, unauthorized access, or complete compromise of the affected device. Since NFC is often used for contactless communication, an attacker might need to be physically close to the device to exploit this.

Mitigation Strategies

Update the Linux kernel to the latest patched version immediately. Disable NFC functionality if not needed. Monitor for suspicious NFC device interactions. Apply kernel patches from your distribution vendor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart