CVE-2026-80795 - Vulnerability Details

- nfc: nci: fix out-of-bounds write in nci_target_auto_activated()

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix out-of-bounds write in nci_target_auto_activated()

nci_target_auto_activated() appends a target to the fixed-size array
ndev->targets[NCI_MAX_DISCOVERED_TARGETS] and increments ndev->n_targets
without first checking the array is full; unlike its sibling
nci_add_new_target(), which bails out when n_targets already equals
NCI_MAX_DISCOVERED_TARGETS.

ndev->n_targets is only cleared by nci_clear_target_list(), so an NFCC
that repeatedly re-runs discovery (RF_DISCOVER_RSP, which re-enters
NCI_DISCOVERY without clearing the target list) and reports an
auto-activated target (RF_INTF_ACTIVATED_NTF) drives n_targets past the
limit. The append then writes a struct nfc_target past the end of the
array (a slab out-of-bounds write), and nfc_targets_found() goes on to
walk the array with the inflated count:

BUG: KASAN: slab-out-of-bounds in nci_add_new_protocol+0x94/0x2ac [nci]
Write of size 2 at addr ffff0000c7299a18 by task kworker/u8:0/12
Workqueue: nfc0_nci_rx_wq nci_rx_work [nci]
Call trace:
nci_add_new_protocol+0x94/0x2ac [nci]
nci_ntf_packet+0xddc/0x11a0 [nci]
nci_rx_work+0x15c/0x1e0 [nci]
process_one_work+0x2dc/0x500
worker_thread+0x240/0x460
kthread+0x1c0/0x1d0
ret_from_fork+0x10/0x20

The buggy address belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1024 bytes to the right of
allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618)

Guard nci_target_auto_activated() with the same check used by
nci_add_new_target().

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

nci_target_auto_activated() appends a target to a fixed buffer without verifying that the array has space left, resulting in a slab out-of-bounds write. The vulnerability can corrupt kernel memory and may lead to privilege escalation or denial of service on systems using the NFC NCI driver.

Affected Systems

The flaw exists in the Linux kernel’s NFC NCI subsystem. Systems running kernel versions that have not yet incorporated the patch are affected; the advisory does not enumerate exact kernel releases.

Risk and Exploitability

No CVSS score is listed and the EPSS metric is unavailable. The vulnerability is not present in CISA KEV, indicating no publicly known active exploits. An attacker would need the ability to send crafted NFC frames or repeatedly trigger discovery on a local NFC device, so the risk is moderate but potentially high in environments with exposed NFC hardware.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< 0dc59de0075f88404a0f4a2b5233104ef459fbb2
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< 94530ffabfca57e9bff1d207106010014cc84032
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< afd8605fb43becb892311102844955c3b127fc7e
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< 24761d3a5f692df5f7d848caeabcb2afd10917aa
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< 50e87e1c0e18d791dcd7dccf30f9a2f3e2cf3951
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< 2f08dbce3b37624ec6b424d759336a99586170ec
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< d7083f41c21b30582e91b2e6de4d54dce74f6f9c
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< 129032c0616d83a5e3e304f6ebf88f14ba01e5f7
`019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5`	affected	< ac200079db50af81e6b04d058b33ec92901d8edd

Linux

affected

Version	Status	Constraints
`3.4`	affected	—
`0`	unaffected	< 3.4
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,0dc59de0075f88404a0f4a2b5233104ef459fbb2)`	affected	code_commit	—
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,94530ffabfca57e9bff1d207106010014cc84032)`	affected	code_commit	—
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,afd8605fb43becb892311102844955c3b127fc7e)`	affected	code_commit	—
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,24761d3a5f692df5f7d848caeabcb2afd10917aa)`	affected	code_commit	—
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,50e87e1c0e18d791dcd7dccf30f9a2f3e2cf3951)`	affected	code_commit	—
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,2f08dbce3b37624ec6b424d759336a99586170ec)`	affected	code_commit	—
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,d7083f41c21b30582e91b2e6de4d54dce74f6f9c)`	affected	code_commit	—
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,129032c0616d83a5e3e304f6ebf88f14ba01e5f7)`	affected	code_commit	—
`[019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5,ac200079db50af81e6b04d058b33ec92901d8edd)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.4`	affected	semver	—
`[0,3.4)`	unaffected	semver	—
`[5.10.267,5.11.0)`	unaffected	semver	—
`[5.15.218,5.16.0)`	unaffected	semver	—
`[6.1.185,6.2.0)`	unaffected	semver	—
`[6.6.154,6.7.0)`	unaffected	semver	—
`[6.12.106,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the patch for nci_target_auto_activated (e.g., the commit identified by 0dc59de)
If an immediate kernel upgrade is not possible, unload or disable the nci NFC module or disconnect the NFC hardware to prevent the vulnerability from being exercised
Verify that no external NFC tags can trigger discovery by disabling NFC services or using firewall rules to block NFC traffic
Reboot the system after applying any changes to ensure the vulnerable code is not loaded

Generated by OpenCVE AI on September 4, 2026 at 16:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0dc59de0075f88404a0f4a2b5233104ef459fbb2
https://git.kernel.org/stable/c/129032c0616d83a5e3e304f6ebf88f14ba01e5f7
https://git.kernel.org/stable/c/24761d3a5f692df5f7d848caeabcb2afd10917aa
https://git.kernel.org/stable/c/2f08dbce3b37624ec6b424d759336a99586170ec
https://git.kernel.org/stable/c/50e87e1c0e18d791dcd7dccf30f9a2f3e2cf3951
https://git.kernel.org/stable/c/94530ffabfca57e9bff1d207106010014cc84032
https://git.kernel.org/stable/c/ac200079db50af81e6b04d058b33ec92901d8edd
https://git.kernel.org/stable/c/afd8605fb43becb892311102844955c3b127fc7e
https://git.kernel.org/stable/c/d7083f41c21b30582e91b2e6de4d54dce74f6f9c

History

Fri, 04 Sep 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-787

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in nci_target_auto_activated() nci_target_auto_activated() appends a target to the fixed-size array ndev->targets[NCI_MAX_DISCOVERED_TARGETS] and increments ndev->n_targets without first checking the array is full; unlike its sibling nci_add_new_target(), which bails out when n_targets already equals NCI_MAX_DISCOVERED_TARGETS. ndev->n_targets is only cleared by nci_clear_target_list(), so an NFCC that repeatedly re-runs discovery (RF_DISCOVER_RSP, which re-enters NCI_DISCOVERY without clearing the target list) and reports an auto-activated target (RF_INTF_ACTIVATED_NTF) drives n_targets past the limit. The append then writes a struct nfc_target past the end of the array (a slab out-of-bounds write), and nfc_targets_found() goes on to walk the array with the inflated count: BUG: KASAN: slab-out-of-bounds in nci_add_new_protocol+0x94/0x2ac [nci] Write of size 2 at addr ffff0000c7299a18 by task kworker/u8:0/12 Workqueue: nfc0_nci_rx_wq nci_rx_work [nci] Call trace: nci_add_new_protocol+0x94/0x2ac [nci] nci_ntf_packet+0xddc/0x11a0 [nci] nci_rx_work+0x15c/0x1e0 [nci] process_one_work+0x2dc/0x500 worker_thread+0x240/0x460 kthread+0x1c0/0x1d0 ret_from_fork+0x10/0x20 The buggy address belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1024 bytes to the right of allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618) Guard nci_target_auto_activated() with the same check used by nci_add_new_target().
Title		nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0dc59de0075f88404a0f4a2b5233104ef459fbb2 https://git.kernel.org/stable/c/129032c0616d83a5e3e304f6ebf88f14ba01e5f7 https://git.kernel.org/stable/c/24761d3a5f692df5f7d848caeabcb2afd10917aa https://git.kernel.org/stable/c/2f08dbce3b37624ec6b424d759336a99586170ec https://git.kernel.org/stable/c/50e87e1c0e18d791dcd7dccf30f9a2f3e2cf3951 https://git.kernel.org/stable/c/94530ffabfca57e9bff1d207106010014cc84032 https://git.kernel.org/stable/c/ac200079db50af81e6b04d058b33ec92901d8edd https://git.kernel.org/stable/c/afd8605fb43becb892311102844955c3b127fc7e https://git.kernel.org/stable/c/d7083f41c21b30582e91b2e6de4d54dce74f6f9c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:13:08.640Z

Updated: 2026-09-04T15:13:08.640Z

Reserved: 2026-08-26T14:34:25.793Z

Link: CVE-2026-80795

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:06.020

Modified: 2026-09-04T16:18:06.020

Link: CVE-2026-80795

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T19:00:13Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object