The vulnerability occurs because the Linux kernel’s NFC LLCP module performs an unbounded walk of a Type‑Length‑Value (TLV) list in the function that parses CONNECT or CC PDUs. The code reads two‑byte headers and length fields without verifying that they stay within the packet buffer, which allows an attacker to craft a malicious packet that causes an out‑of‑bounds read. The exposed data can be used for information disclosure, representing a classic unchecked input validation flaw (CWE‑20).

All Linux kernels that provide the NFC LLCP stack and lack the patches that bound the TLV walk are affected. The description does not specify exact releases, but any kernel prior to the inclusion of the commit changes that add length checks is vulnerable. The flaw is confined to the kernel component that handles LLCP data, regardless of distribution or hardware vendor.

An attacker only needs to send a malformed CONNECT or CC PDU to the target device; no authentication is required. The exploitation path is local to the NFC interface, making any NFC‑capable device a potential vector. While no CVSS or EPSS score is provided, the issue was discovered by automated security‑research tooling, indicating a realistic attack surface. Because the vulnerability leads to an out‑of‑bounds read, it can compromise confidentiality and integrity of kernel memory. The flaw is not listed in the CISA KEV catalog, but its severity remains high.