An out‑of‑bounds read occurs in the Linux kernel NFC LLCP layer when a received Protocol Data Unit (PDU) is shorter than the mandatory two‑byte header. The code subtracts LLCP_HEADER_SIZE from skb->len, an unsigned size_t subtraction that underflows for overly short frames, and the resulting large value drives the TLV walk far beyond the packet bounds, exposing kernel memory to an attacker.

All systems running the Linux kernel that have the default NFC stack enabled are affected. The issue exists in the core nfc module before the patch that adds header validation. No specific kernel version ranges are listed, but any kernel build including the vulnerable code may be impacted.

The flaw can be triggered by any NFC device in proximity because LLCP link activation occurs automatically following an NFC‑DEP connection, and no authentication is required. While the vulnerability does not provide privilege escalation or a guaranteed denial of service, the out‑of‑bounds read can leak kernel data and, if repeated, may destabilise the system. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no active exploitation has been documented yet. Nevertheless, the remote trigger and potential information disclosure warrant timely patching.