The Linux kernel NFC microread driver interprets discovery payloads sent over the HCI gate. In the vulnerable implementation only the size of the destination buffers is checked, while the actual length of the received socket buffer is ignored. This oversight allows an attacker to craft a discovery frame that is shorter than expected, causing the driver to read or copy beyond the bounds of the skb data. The resulting out‑of‑bounds read can trigger a kernel crash, leading to a denial of service, and may expose sensitive memory contents to a local attacker.

All Linux kernel releases that incorporate the NFC microread driver and have not yet incorporated the payload‑length validation patch. The advisory does not list a specific version range; the fixes are available in the kernel commit history referenced in the advisory links.

A CVSS score is not published and the EPSS score is unavailable, indicating limited public data about exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploitation reports exist. Attackers would need to be able to transmit malicious NFC traffic to the target device, typically requiring proximity or a direct NFC link. If successfully exploited, the kernel fault can precipitate a crash and cause a denial of service while potentially leaking memory data to the attacker.