The fdp_nci_i2c_read function in the Linux NFC driver reads the packet length directly from two bytes supplied by the NFC controller without validating the value. If the length exceeds the 261‑byte on‑stack buffer, the function writes past the buffer boundary, overwriting the kernel stack canary and return address, an exploit that can corrupt kernel control flow and lead to arbitrary code execution with kernel privileges. The same code path also allocates a socket buffer for each data packet but assumes a strict interleaving of a length packet followed by a data packet. When a controller sends two data packets in a single call, the first buffer is leaked because the second allocation overwrites the reference to it. This memory leak can gradually exhaust resources or expose sensitive data. Both problems together enable a local attacker to gain kernel privileges and potentially view or modify kernel memory. The primary impact is local privilege escalation due to the out‑of‑bounds write. Although no public exploit has been reported yet, the nature of the vulnerability suggests high exploitation potential for an attacker who can supply malicious NFC traffic or control an i2c bus. The vulnerability is not listed in CISA’s KEV catalog and no EPSS score is available, but the lack of public hinges does not diminish the risk for systems with NFC functionality exposed to untrusted devices. The likely attack vector is the NFC controller or an interposed i2c bus that feeds crafted packets into the kernel; the attacker must have the ability to send arbitrary NFC frames to the vulnerable host.

This weakness exists in the Linux kernel’s NFC subsystem, specifically in the fdp driver. Any kernel that compiles the current nfcn driver without the patch is vulnerable, regardless of the kernel’s release version. The risk applies to systems that load the generic nfc module and have an NFC controller attached. If a distribution disables the NFC module by default, the impact is limited to users who enable NFC functionality.

The absence of CVSS and EPSS data does not reduce the inherent risk: a kernel stack overflow with no input validation typically warrants a high-severity rating. The lack of a public exploit in KEV suggests no widespread attacks yet, but the exploit requires only local access to the i2c/NFC bus, which is feasible in many environments (e.g., embedded devices, IoT gateways). The attacker’s prerequisites are minimal: creating a malicious NFC payload or intercepting bus traffic. Given the high potential for kernel compromise, the risk can be considered high for any system with NFC capability. The mitigations below address both the stack overrun and the buffer leak, effectively neutralizing the vulnerability when applied.