The Linux kernel NFC driver accepts a cascade depth for NFC‑A anti‑collision that is driven entirely by the peer device, without checking against the three‑level limit defined by ISO 14443‑3. If a malicious partner keeps the cascade in motion, the driver appends three or four bytes to the target->nfcid1 field on each pass. Because target->nfcid1 is sized for only ten bytes, repeated rounds can overwrite adjacent heap memory. The CVE description states that the driver allows this overflow, implying a buffer overflow condition; however, the description does not explicitly confirm that this leads to arbitrary code execution, so that outcome is an inference.

Linux kernel builds that enable the NFC digital driver are affected. The flaw exists in any kernel release before the commit that introduces bounds checking for the nfc_target arrays, which was merged for all standard distributions after the vulnerability was reported. Systems that have not upgraded to a patched kernel will still be vulnerable.

The vulnerability received a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1% suggests that, at the time of analysis, exploitation attempts are infrequent. The most probable attack vector involves a physically proximate NFC‑capable device able to send a specially crafted message to the target system. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploit has been documented.