CVE-2026-80823 - Vulnerability Details

- nfc: st21nfca: validate ATR_REQ length against the received frame

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate ATR_REQ length against the received frame

st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at
least ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req->length
is at least sizeof(struct st21nfca_atr_req), but never checks that
atr_req->length does not exceed the actual received length (skb->len).

st21nfca_tm_send_atr_res() then trusts the declared length:

gb_len = atr_req->length - sizeof(struct st21nfca_atr_req);
...
memcpy(atr_res->gbi, atr_req->gbi, gb_len);

so an RF peer that sends a short frame but sets atr_req->length larger
than the frame makes gb_len exceed the general bytes actually present,
and the memcpy reads out of bounds past the received skb. Those bytes are
placed in the ATR_RES and sent back to the peer (kernel-memory disclosure
to a proximity attacker); a larger declared length is an out-of-bounds
read (DoS).

Reject frames whose declared length exceeds the received length. The
adjacent nfc_tm_activated() path in the same function already derives its
general-bytes length from skb->len rather than the declared field.

Found by 0sec (https://0sec.ai) using automated source analysis; the
missing bound is evident from source. Compile-tested.

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The st21nfca NFC driver fails to verify that the length declared in an ATR_REQ frame does not exceed the actual bytes received. A nearby peer can send a truncated frame that advertises a larger length, causing the driver to read beyond the received data when building the response. This out‑of‑bounds read exposes kernel memory contents to an attacker in proximity and can trigger a crash, resulting in a denial‑of‑service condition.

Affected Systems

All Linux kernel installations that include the NFC subsystem’s st21nfca driver are affected.

Risk and Exploitability

The attack vector requires a proximity NFC interaction, typically achievable by a nearby device such as a smartphone or card reader. Because the exploit depends on a specific NFC exchange, the probability of widespread exploitation remains low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the lack of a length boundary check means any valid contact could leak kernel memory or destabilize the system if the peer fabricates a deceptive length field.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< 785df00bb3ae3206674a43284eb06dac575b5c64
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< 2c1ad291f4cdc357f9527b688c6fda9c6ffa7890
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< dd26d30f40c43ad9cfe2f25c6ea0ead1dd51d5aa
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< 9635507fe82949e429b3cd938876a9917125b151
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< 0f344944c506b4f02d2b098489f7268b438c369e
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< bfcca5f42c9aa4eadef1e5fe7bb23783d7fcc96d
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< 304f5b414f4051d324b8c4a3ab0e79f7dc7e150e
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< f33cecf69095c43be88567fef92b180b858f7369
`1892bf844ea0261736bd5e75546fc996e9daeedf`	affected	< 5cdcca5d62a66eda6b774110a44cba67bc1a8d1d

Linux

affected

Version	Status	Constraints
`3.17`	affected	—
`0`	unaffected	< 3.17
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1892bf844ea0261736bd5e75546fc996e9daeedf,785df00bb3ae3206674a43284eb06dac575b5c64)`	affected	code_commit	—
`[1892bf844ea0261736bd5e75546fc996e9daeedf,2c1ad291f4cdc357f9527b688c6fda9c6ffa7890)`	affected	code_commit	—
`[1892bf844ea0261736bd5e75546fc996e9daeedf,dd26d30f40c43ad9cfe2f25c6ea0ead1dd51d5aa)`	affected	code_commit	—
`[1892bf844ea0261736bd5e75546fc996e9daeedf,9635507fe82949e429b3cd938876a9917125b151)`	affected	code_commit	—
`[1892bf844ea0261736bd5e75546fc996e9daeedf,0f344944c506b4f02d2b098489f7268b438c369e)`	affected	code_commit	—
`[1892bf844ea0261736bd5e75546fc996e9daeedf,bfcca5f42c9aa4eadef1e5fe7bb23783d7fcc96d)`	affected	code_commit	—
`[1892bf844ea0261736bd5e75546fc996e9daeedf,304f5b414f4051d324b8c4a3ab0e79f7dc7e150e)`	affected	code_commit	—
`[1892bf844ea0261736bd5e75546fc996e9daeedf,f33cecf69095c43be88567fef92b180b858f7369)`	affected	code_commit	—
`[1892bf844ea0261736bd5e75546fc996e9daeedf,5cdcca5d62a66eda6b774110a44cba67bc1a8d1d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.17`	affected	semver	—
`[0,3.17)`	unaffected	semver	—
`[5.10.267,5.11.0)`	unaffected	semver	—
`[5.15.218,5.16.0)`	unaffected	semver	—
`[6.1.185,6.2.0)`	unaffected	semver	—
`[6.6.154,6.7.0)`	unaffected	semver	—
`[6.12.106,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a kernel version that includes the st21nfca length validation patch.
If no update is immediately available, blacklist or unload the st21nfca module to prevent the driver from loading.
Physically disable or remove NFC hardware components that could initiate ATR_REQ exchanges.

Generated by OpenCVE AI on September 4, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f344944c506b4f02d2b098489f7268b438c369e
https://git.kernel.org/stable/c/2c1ad291f4cdc357f9527b688c6fda9c6ffa7890
https://git.kernel.org/stable/c/304f5b414f4051d324b8c4a3ab0e79f7dc7e150e
https://git.kernel.org/stable/c/5cdcca5d62a66eda6b774110a44cba67bc1a8d1d
https://git.kernel.org/stable/c/785df00bb3ae3206674a43284eb06dac575b5c64
https://git.kernel.org/stable/c/9635507fe82949e429b3cd938876a9917125b151
https://git.kernel.org/stable/c/bfcca5f42c9aa4eadef1e5fe7bb23783d7fcc96d
https://git.kernel.org/stable/c/dd26d30f40c43ad9cfe2f25c6ea0ead1dd51d5aa
https://git.kernel.org/stable/c/f33cecf69095c43be88567fef92b180b858f7369

History

Fri, 04 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Fri, 04 Sep 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATR_REQ length against the received frame st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at least ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req->length is at least sizeof(struct st21nfca_atr_req), but never checks that atr_req->length does not exceed the actual received length (skb->len). st21nfca_tm_send_atr_res() then trusts the declared length: gb_len = atr_req->length - sizeof(struct st21nfca_atr_req); ... memcpy(atr_res->gbi, atr_req->gbi, gb_len); so an RF peer that sends a short frame but sets atr_req->length larger than the frame makes gb_len exceed the general bytes actually present, and the memcpy reads out of bounds past the received skb. Those bytes are placed in the ATR_RES and sent back to the peer (kernel-memory disclosure to a proximity attacker); a larger declared length is an out-of-bounds read (DoS). Reject frames whose declared length exceeds the received length. The adjacent nfc_tm_activated() path in the same function already derives its general-bytes length from skb->len rather than the declared field. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.
Title		nfc: st21nfca: validate ATR_REQ length against the received frame
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f344944c506b4f02d2b098489f7268b438c369e https://git.kernel.org/stable/c/2c1ad291f4cdc357f9527b688c6fda9c6ffa7890 https://git.kernel.org/stable/c/304f5b414f4051d324b8c4a3ab0e79f7dc7e150e https://git.kernel.org/stable/c/5cdcca5d62a66eda6b774110a44cba67bc1a8d1d https://git.kernel.org/stable/c/785df00bb3ae3206674a43284eb06dac575b5c64 https://git.kernel.org/stable/c/9635507fe82949e429b3cd938876a9917125b151 https://git.kernel.org/stable/c/bfcca5f42c9aa4eadef1e5fe7bb23783d7fcc96d https://git.kernel.org/stable/c/dd26d30f40c43ad9cfe2f25c6ea0ead1dd51d5aa https://git.kernel.org/stable/c/f33cecf69095c43be88567fef92b180b858f7369

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:27:46.153Z

Updated: 2026-09-04T15:29:25.316Z

Reserved: 2026-08-26T14:34:25.795Z

Link: CVE-2026-80823

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:10.080

Modified: 2026-09-04T16:18:10.080

Link: CVE-2026-80823

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T16:45:05Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object