The Linux kernel NFC stack contains a flaw in the function that validates Service Access Point (SAP) names. The function only compares the length of the requested service name, allowing a short name such as "u" to match a longer WKS string like "urn:nfc:sn:snep". This mismatch means an attacker could send a crafted NFC LLCP request that hijacks the WKS SAP, thereby gaining control over the NFC link layer and potentially interfering with legitimate NFC communications. The vulnerability is classified as CWE-1025, an improper string comparison that can lead to improper validation of inputs.

All Linux kernel versions that do not contain the patch that enforces an exact length comparison in nfc_llcp_wks_sap() are affected. The commit that resolves the issue is 0a0412745c86acd089c6460da715ab966b1615e7, and any kernel snapshot prior to its integration is considered vulnerable. Because the CVE data does not list explicit version numbers, the safest assumption is that any distribution shipping a kernel older than the patch commit is impacted.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% indicates a currently low probability that this vulnerability will be exploited at scale. The CVE is not listed in the CISA KEV catalog, and no public exploit is known. The likely attack vector is an NFC-enabled device that can send a malicious LLCP packet to the target system; based on the description, it is inferred that an attacker would need physical or network proximity to the target to conduct the exploit. Overall, the theoretical risk remains limited until a specific exploit is discovered or the attack surface is expanded.