This vulnerability arises in the Linux kernel NFC (nfcmrvl) firmware download path where the NCI data header is stripped and the helper command is read before the packet length is validated. A short or malformed frame can therefore reach the data access routine before the malformed packet is rejected, exposing the kernel to uncontrolled memory access. The flaw represents an improper bounds check on user‑provided data and may allow a local attacker to trigger arbitrary kernel memory reads or writes, leading to privilege escalation or a denial of service.

Affected systems include all Linux kernel implementations that contain the nfcmrvl NFC driver before the latest commit which added the length validation. The vulnerability is not tied to a specific kernel release in the data; systems running any Linux kernel version lacking the recent fix are susceptible. Users with NFC hardware that engages the nfcmrvl driver are at risk.

The CVSS score is 4.4, and EPSS is < 1%, so the overall exposure cannot be quantified precisely from the data. However, because the flaw occurs in a kernel device driver and gives the attacker local control over the NFC subsystem, it is reasonable to assume a high severity impact for systems with the affected driver enabled. Attackers would need local access to the NIC and the ability to send crafted frames; this is inferred based on the nature of the bug. No known remote exploitation vector is documented, and the vulnerability is not listed in the CISA KEV database.