The Linux kernel NFC st21nfca driver trims a received frame at its end‑of‑frame marker before byte‑unstuffing and then assumes the truncated frame contains an LLC header and two CRC bytes. It also unconditionally reads the byte following an escape marker. If a malformed frame places the EOF immediately after the start marker or ends with an escape marker, the driver has fewer bytes available for CRC checking or will read past the skb boundary while unstuffing, leading to a buffer over‑read and potential kernel memory corruption.

This issue affects all kernel releases that include the st21nfca NFC driver before the latest patch is applied. It is present in the general Linux kernel, regardless of distribution, and manifests on any system with an NFC controller that uses the st21nfca driver.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, is that an adversary would need to deliver a specially crafted NFC frame, for example by presenting a malicious tag to the compromised NFC controller. Such a frame can trigger a buffer over‑read and cause a kernel crash, resulting in denial of service. No public exploits have been reported, so the exploitation probability is low, but the medium impact warrants prompt remediation.