nfc: nci: add data_len bound checks to activation parameter extractors

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80796
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-04 16:18:06 UTC
Updated2026-09-04 16:18:06 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: nfc: nci: add data_len bound checks to activation parameter extractors nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() read an inner length byte from the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed kernel buffers, but neither function receives the caller-validated activation_params_len. A crafted NCI notification with activation_params_len=1 and an inner length byte of up to 20 (NFC-A) or 50 (NFC-B) causes memcpy() to read that many bytes past the one valid byte in the activation params region -- a slab out-of-bounds read of kernel memory adjacent to the NCI skb. The sibling nci_extract_rf_params_*() family was given equivalent protection by commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter validation for packet data"), but the two activation parameter extractors were not updated at that time. Add a data_len parameter to both functions, guard against an empty region before consuming the inner length byte, decrement the remaining count after consuming it, and clamp the copy length to what is actually available. Update both call sites to pass ntf.activation_params_len, which is already validated against the skb at ntf.c:801.

Risk And Classification

EPSS: 0.001950000 probability, percentile 0.092840000 (date 2026-09-07)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 1168484fe2b3828bf24a46f3c42a8719fade679b git Not specified
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 be311c0cfeadfbe815ea22d2914a98d06e3fab0e git Not specified
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 04e51353cb9fa321caaeeed8331d4cd041fbaca7 git Not specified
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 e25b44bd8b8cc666b49a3fe0ef547e64d5b1e300 git Not specified
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 9b01f5af0dc59263b59391b148bc78d83c0354a9 git Not specified
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 9620a91f8d643b680f417a435db399a04d1e06d8 git Not specified
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 cf9d44be50b9074a5abdc301b4a3ba3e283591df git Not specified
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 f5c534b53f8c424a8e7633c9b585475c4bf4ee18 git Not specified
CNA Linux Linux affected e8c0dacd9836dc2dcb28d236c9cc3cfaa9965a20 0428fa2c22e2ba0cff766d3b80d461e149102045 git Not specified
CNA Linux Linux affected 3.3 Not specified
CNA Linux Linux unaffected 3.3 semver Not specified
CNA Linux Linux unaffected 5.10.269 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.220 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.187 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.156 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.108 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.47 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.11 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2.1 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/cf9d44be50b9074a5abdc301b4a3ba3e283591df 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1168484fe2b3828bf24a46f3c42a8719fade679b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/04e51353cb9fa321caaeeed8331d4cd041fbaca7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e25b44bd8b8cc666b49a3fe0ef547e64d5b1e300 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f5c534b53f8c424a8e7633c9b585475c4bf4ee18 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9620a91f8d643b680f417a435db399a04d1e06d8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/be311c0cfeadfbe815ea22d2914a98d06e3fab0e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0428fa2c22e2ba0cff766d3b80d461e149102045 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9b01f5af0dc59263b59391b148bc78d83c0354a9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report