CVE-2026-80796 - Vulnerability Details

- nfc: nci: add data_len bound checks to activation parameter extractors

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: add data_len bound checks to activation parameter extractors

nci_extract_activation_params_iso_dep() and
nci_extract_activation_params_nfc_dep() read an inner length byte from
the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed
kernel buffers, but neither function receives the caller-validated
activation_params_len. A crafted NCI notification with
activation_params_len=1 and an inner length byte of up to 20 (NFC-A) or
50 (NFC-B) causes memcpy() to read that many bytes past the one valid
byte in the activation params region -- a slab out-of-bounds read of
kernel memory adjacent to the NCI skb.

The sibling nci_extract_rf_params_*() family was given equivalent
protection by commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter
validation for packet data"), but the two activation parameter
extractors were not updated at that time.

Add a data_len parameter to both functions, guard against an empty
region before consuming the inner length byte, decrement the remaining
count after consuming it, and clamp the copy length to what is actually
available. Update both call sites to pass ntf.activation_params_len,
which is already validated against the skb at ntf.c:801.

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

A crafted NFC notification can cause the Linux kernel to read up to 20 or 50 bytes beyond a single-byte activation parameter region, leading to an out‑of‑bounds kernel memory read. The vulnerability lies in missing bounds checks in two nfc/nci activation parameter extractors, allowing an attacker to expose kernel data adjacent to the sk_buff. This read can leak sensitive information, facilitate privilege escalation, or aid further exploitation, impacting confidentiality system‑wide.

Affected Systems

All Linux kernel builds that include the nfc/nci subsystem prior to the patch that adds bound checks are affected. The fix is applied in all downstream distributions that update to a kernel containing the commit implementing the data_len parameter validation. Versions without the patch have the vulnerability present.

Risk and Exploitability

The relative severity is not scored (no CVSS provided) and the EPSS score is unavailable, but the vulnerability is not currently listed in CISA KEV. The exploit requires crafting a malicious NFC notification, which could be delivered locally by a nearby NFC device or remotely if the system accepts NFC traffic from untrusted sources. The lack of publicly known exploits and the dependence on physical or proximate access suggest a moderate risk, provided the nfc/nci stack is active and the kernel is vulnerable.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< 1168484fe2b3828bf24a46f3c42a8719fade679b
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< be311c0cfeadfbe815ea22d2914a98d06e3fab0e
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< 04e51353cb9fa321caaeeed8331d4cd041fbaca7
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< e25b44bd8b8cc666b49a3fe0ef547e64d5b1e300
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< 9b01f5af0dc59263b59391b148bc78d83c0354a9
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< 9620a91f8d643b680f417a435db399a04d1e06d8
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< cf9d44be50b9074a5abdc301b4a3ba3e283591df
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< f5c534b53f8c424a8e7633c9b585475c4bf4ee18
`e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20`	affected	< 0428fa2c22e2ba0cff766d3b80d461e149102045

Linux

affected

Version	Status	Constraints
`3.3`	affected	—
`0`	unaffected	< 3.3
`5.10.269`	unaffected	≤ 5.10.*
`5.15.220`	unaffected	≤ 5.15.*
`6.1.187`	unaffected	≤ 6.1.*
`6.6.156`	unaffected	≤ 6.6.*
`6.12.108`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,1168484fe2b3828bf24a46f3c42a8719fade679b)`	affected	code_commit	—
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,be311c0cfeadfbe815ea22d2914a98d06e3fab0e)`	affected	code_commit	—
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,04e51353cb9fa321caaeeed8331d4cd041fbaca7)`	affected	code_commit	—
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,e25b44bd8b8cc666b49a3fe0ef547e64d5b1e300)`	affected	code_commit	—
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,9b01f5af0dc59263b59391b148bc78d83c0354a9)`	affected	code_commit	—
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,9620a91f8d643b680f417a435db399a04d1e06d8)`	affected	code_commit	—
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,cf9d44be50b9074a5abdc301b4a3ba3e283591df)`	affected	code_commit	—
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,f5c534b53f8c424a8e7633c9b585475c4bf4ee18)`	affected	code_commit	—
`[e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20,0428fa2c22e2ba0cff766d3b80d461e149102045)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.3`	affected	generic	—
`[0,3.3)`	unaffected	generic	—
`[5.10.269,5.11.0)`	unaffected	semver	—
`[5.15.220,5.16.0)`	unaffected	semver	—
`[6.1.187,6.2.0)`	unaffected	semver	—
`[6.6.156,6.7.0)`	unaffected	semver	—
`[6.12.108,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to the latest Linux kernel release that incorporates the commit adding data_len bounds checks to the nfc/nci activation parameter extractors.
If an upgrade is not immediately possible, disable or unload the nfc and nci kernel modules to eliminate the vulnerable code path.
Restrict or block unsolicited NFC traffic from untrusted devices using firewall or device‑level access controls to reduce the likelihood of an attacker delivering a crafted notification.

Generated by OpenCVE AI on September 4, 2026 at 17:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0428fa2c22e2ba0cff766d3b80d461e149102045
https://git.kernel.org/stable/c/04e51353cb9fa321caaeeed8331d4cd041fbaca7
https://git.kernel.org/stable/c/1168484fe2b3828bf24a46f3c42a8719fade679b
https://git.kernel.org/stable/c/9620a91f8d643b680f417a435db399a04d1e06d8
https://git.kernel.org/stable/c/9b01f5af0dc59263b59391b148bc78d83c0354a9
https://git.kernel.org/stable/c/be311c0cfeadfbe815ea22d2914a98d06e3fab0e
https://git.kernel.org/stable/c/cf9d44be50b9074a5abdc301b4a3ba3e283591df
https://git.kernel.org/stable/c/e25b44bd8b8cc666b49a3fe0ef547e64d5b1e300
https://git.kernel.org/stable/c/f5c534b53f8c424a8e7633c9b585475c4bf4ee18

History

Fri, 04 Sep 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add data_len bound checks to activation parameter extractors nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() read an inner length byte from the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed kernel buffers, but neither function receives the caller-validated activation_params_len. A crafted NCI notification with activation_params_len=1 and an inner length byte of up to 20 (NFC-A) or 50 (NFC-B) causes memcpy() to read that many bytes past the one valid byte in the activation params region -- a slab out-of-bounds read of kernel memory adjacent to the NCI skb. The sibling nci_extract_rf_params_*() family was given equivalent protection by commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter validation for packet data"), but the two activation parameter extractors were not updated at that time. Add a data_len parameter to both functions, guard against an empty region before consuming the inner length byte, decrement the remaining count after consuming it, and clamp the copy length to what is actually available. Update both call sites to pass ntf.activation_params_len, which is already validated against the skb at ntf.c:801.
Title		nfc: nci: add data_len bound checks to activation parameter extractors
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0428fa2c22e2ba0cff766d3b80d461e149102045 https://git.kernel.org/stable/c/04e51353cb9fa321caaeeed8331d4cd041fbaca7 https://git.kernel.org/stable/c/1168484fe2b3828bf24a46f3c42a8719fade679b https://git.kernel.org/stable/c/9620a91f8d643b680f417a435db399a04d1e06d8 https://git.kernel.org/stable/c/9b01f5af0dc59263b59391b148bc78d83c0354a9 https://git.kernel.org/stable/c/be311c0cfeadfbe815ea22d2914a98d06e3fab0e https://git.kernel.org/stable/c/cf9d44be50b9074a5abdc301b4a3ba3e283591df https://git.kernel.org/stable/c/e25b44bd8b8cc666b49a3fe0ef547e64d5b1e300 https://git.kernel.org/stable/c/f5c534b53f8c424a8e7633c9b585475c4bf4ee18

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:13:09.857Z

Updated: 2026-09-04T15:13:09.857Z

Reserved: 2026-08-26T14:34:25.793Z

Link: CVE-2026-80796

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:06.180

Modified: 2026-09-04T16:18:06.180

Link: CVE-2026-80796

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T23:00:15Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object