The Linux kernel NFC driver contains an out‑of‑bounds read flaw in the ISO15693 inventory helper used by the st21nfca driver. The routine removes a two‑byte prefix from an incoming NFC packet without verifying that the prefix exists, then accepts a single remaining byte before interpreting the next byte as the DSFID. Because the driver copies UID data and reads the DSFID from a buffer that may be shorter than expected, the kernel can dereference an address derived from insufficient input and read kernel memory. This behavior corresponds to a CWE‑125 request for data, which allows confidential information to be exposed.

The flaw resides in the Linux kernel’s NFC stack, specifically the st21nfca driver. While specific kernel versions are not enumerated in the advisory, any kernel containing the legacy st21nfca implementation prior to the patch that adds length validation is affected. This includes all Linux distributions that ship that driver without the update.

Exploitation requires an attacker to physically present a malicious NFC tag to a device that processes NFC traffic with the vulnerable driver. The likely attack vector is inferred from the description, as the vulnerability is triggered by incoming NFC packets during ISO15693 inventory handling. The exploit is a local memory read; it does not require administrative privileges to trigger but may lead to further compromise if kernel memory contents reveal secrets or can be leveraged for privilege escalation. The EPSS score of less than 1 percent suggests a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 6.5 indicates a moderate severity, and the presence of the weakness in the kernel warrants attention.