The Linux kernel’s NFC HCI subsystem contains a flaw where the functions nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read packet->header from skb->data without first ensuring the buffer contains at least one byte. A malicious NFC peer can transmit a 0‑byte HCP frame that bypasses the SHDLC layer and reaches these functions, leading to an out‑of‑bounds heap read that exposes kernel data. If the 0‑byte frame is queued as a non‑final fragment, the reassembly loop underflows msg_len to UINT_MAX, causing skb_over_panic() when the reassembled skb is written, which crashes the kernel. The impact is a high‑severity denial of service that does not provide remote code execution. Based on the description, it is inferred that the failure to validate input reflects an out‑of‑bounds read that could allow reading sensitive kernel memory and causing a crash.

Any Linux kernel version with the NFC HCI subsystem enabled that has not yet applied the patch is affected. This includes all distributions that ship the unpatched kernel and have NFC hardware active; the vulnerability is not limited by architecture or user‑space configuration. Based on the description, this applies to any system where the NFC HCI interface is enabled and exposed to external NFC peers.

The CVSS score of 8.8 indicates high severity. With an EPSS score of less than 1%, exploitation instances are expected to be infrequent, and the issue is not listed in CISA KEV. The attack requires a malicious NFC peer to send a crafted 0‑byte HCP frame to a target device with NFC enabled, making it a remote attack that requires proximity or a compromised NFC interface. The likely attack vector is proximity‑based NFC communication, inferred from the need for a malicious peer to transmit frames, suggesting that physical proximity or access to the device’s NFC radio is required. On exploitation the kernel will crash due to the skb_over_panic() trigger, leading to service interruption without privilege escalation.