A flaw in the Linux kernel’s NFC NCI driver improperly validates packet data, particularly for variable-length packets. The validation logic compares packet contents to the size of a fixed struct, causing misinterpretation when packets exceed the expected limits. This leads to a failure of NFC communication, effectively disabling the driver and resulting in a denial of service.

The vulnerability affects any Linux system running a kernel version prior to the commit that introduced proper validation for NFC NCI packet data. It is relevant to all distributions that ship the kernel with the unpatched NCI driver, regardless of specific distribution or hardware model, as long as the NFC NCI driver is enabled.

Attackers would need the ability to inject malformed NFC packets through the NFC interface. If an attacker can send crafted packets, the driver will fail, disrupting NFC functionality. No publicly known exploits exist, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a low but non-zero risk of exploitation.