CVE-2026-80803 - Vulnerability Details

- nfc: digital: clamp SENSF_RES length to the destination buffer

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: digital: clamp SENSF_RES length to the destination buffer

digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote
NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res
field without an upper-bound check. A nearby malicious NFC-F device can
send an oversized SENSF_RES response to overflow the stack-local struct
nfc_target.

Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy.

Found by 0sec automated security-research tooling (https://0sec.ai).

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability allows a malicious NFC‑F device to send an oversized SENSF_RES response that is copied unsafely into a kernel stack buffer via memcpy. Because the length is not limited, the copy can overwrite arbitrary stack memory, potentially corrupting control data and enabling arbitrary code execution or a denial‑of‑service by crashing the kernel.

Affected Systems

This flaw affects the Linux kernel when the NFC subsystem is enabled. No specific kernel version is listed, so all releases that contain the vulnerable path are impacted.

Risk and Exploitability

The flaw is a classic stack buffer overflow in kernel space, with a high impact if exploited. EPSS data is not available and the vulnerability is not currently listed in the CISA KEV catalog. An attacker must have a nearby NFC‑F device to transmit the crafted response, but once the malformed packet is processed the kernel can be compromised. The severity can be expected to be high, similar to other unchecked memcpy vulnerabilities in the kernel.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< 6afb29751ee731e7f7a96feb8a15f91441e552ba
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< e886c63d2ca7108826076989103a1ffa8a0bb8f4
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< 4e942da2869bcd646353eef706b7dd82efeb9db5
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< d0756a98277e383c26fead988a96c91f0781cd7f
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< af4c0606f743e009254a8d252096855335ade85d
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< a56773e649ea99b344d6bbaf90f34c8e3fadef5d
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< 31aa28ed732f66ab83c40ef53d99791be69b85c4
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< 344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16

Linux

affected

Version	Status	Constraints
`3.13`	affected	—
`0`	unaffected	< 3.13
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8c0695e4998dd268ff2a05951961247b7e015651,6afb29751ee731e7f7a96feb8a15f91441e552ba)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,e886c63d2ca7108826076989103a1ffa8a0bb8f4)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,4e942da2869bcd646353eef706b7dd82efeb9db5)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,d0756a98277e383c26fead988a96c91f0781cd7f)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,af4c0606f743e009254a8d252096855335ade85d)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,a56773e649ea99b344d6bbaf90f34c8e3fadef5d)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,31aa28ed732f66ab83c40ef53d99791be69b85c4)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.13`	affected	generic	—
`[0,3.13)`	unaffected	generic	—
`[5.10.267,5.11.0)`	unaffected	semver	—
`[5.15.218,5.16.0)`	unaffected	semver	—
`[6.1.185,6.2.0)`	unaffected	semver	—
`[6.6.154,6.7.0)`	unaffected	semver	—
`[6.12.106,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that clamps the SENSF_RES length to NFC_SENSF_RES_MAXSIZE as introduced in the linked commits.
If the patch cannot be applied immediately, disable the NFC driver stack (nfc and related modules) to prevent processing of external NFC frames.
After applying the patch or disabling NFC, reboot the system to clear the vulnerable stack state.

Generated by OpenCVE AI on September 4, 2026 at 17:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/31aa28ed732f66ab83c40ef53d99791be69b85c4
https://git.kernel.org/stable/c/344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16
https://git.kernel.org/stable/c/4e942da2869bcd646353eef706b7dd82efeb9db5
https://git.kernel.org/stable/c/6afb29751ee731e7f7a96feb8a15f91441e552ba
https://git.kernel.org/stable/c/a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6
https://git.kernel.org/stable/c/a56773e649ea99b344d6bbaf90f34c8e3fadef5d
https://git.kernel.org/stable/c/af4c0606f743e009254a8d252096855335ade85d
https://git.kernel.org/stable/c/d0756a98277e383c26fead988a96c91f0781cd7f
https://git.kernel.org/stable/c/e886c63d2ca7108826076989103a1ffa8a0bb8f4

History

Fri, 04 Sep 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120 CWE-125

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target. Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy. Found by 0sec automated security-research tooling (https://0sec.ai).
Title		nfc: digital: clamp SENSF_RES length to the destination buffer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/31aa28ed732f66ab83c40ef53d99791be69b85c4 https://git.kernel.org/stable/c/344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16 https://git.kernel.org/stable/c/4e942da2869bcd646353eef706b7dd82efeb9db5 https://git.kernel.org/stable/c/6afb29751ee731e7f7a96feb8a15f91441e552ba https://git.kernel.org/stable/c/a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6 https://git.kernel.org/stable/c/a56773e649ea99b344d6bbaf90f34c8e3fadef5d https://git.kernel.org/stable/c/af4c0606f743e009254a8d252096855335ade85d https://git.kernel.org/stable/c/d0756a98277e383c26fead988a96c91f0781cd7f https://git.kernel.org/stable/c/e886c63d2ca7108826076989103a1ffa8a0bb8f4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:13:17.298Z

Updated: 2026-09-04T15:13:17.298Z

Reserved: 2026-08-26T14:34:25.794Z

Link: CVE-2026-80803

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:07.250

Modified: 2026-09-04T16:18:07.250

Link: CVE-2026-80803

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T22:30:06Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object