The Linux kernel contains errors in the TLV parsing loops of nfc_llcp_parse_gb_tlv and nfc_llcp_parse_connection_tlv. Because the loop offset is a u8 while the array length is u16, the offset silently wraps after 255 bytes, causing either an infinite loop or duplicate processing of data. Additionally, the code reads TLV header fields and payload values without verifying that the offsets stay within the bounds of the buffer, which allows an attacker to trigger out‑of‑bounds reads when the payload length is set to 0xFF or the TLV is truncated. These errors can lead to kernel memory corruption, information disclosure, and potentially execute arbitrary code within kernel mode.

Both affected functions are reachable from nfc_llcp_set_remote_gb, which accepts data from remote NFC devices without authentication. The vulnerability applies to all Linux kernel builds that include the NFC LLCP stack and have not applied the recent fix. No specific version range is quoted, so any kernel that incorporates the unpatched code is a target.

The CVSS score is not publicly provided, but the nature of the flaw allows a remote attacker controlling an NFC device to send crafted LLCP packets that target kernel memory. The lack of authentication on nfc_llcp_set_remote_gb gives the attacker an easy attack vector, and the absence of a KEV listing does not reduce the intrinsic severity. An exploit that reads or writes beyond bounds could crash the kernel or grant elevated privileges, making the risk high and exploitation likely if the attacker can present a malicious NFC payload.