Executive brief
A vulnerability exists in the Linux kernel's Near Field Communication (NFC) implementation. A malicious NFC device in close physical proximity can send specially crafted responses that cause the kernel to write data beyond its intended memory buffer. This could lead to a system crash or potentially allow an attacker to gain unauthorized control over the affected device.
Technical details
A heap-based buffer overflow exists in the digital_in_recv_sdd_res() function within net/nfc/digital_technology.c. The vulnerability stems from a lack of bounds checking on the NFC-A anti-collision cascade depth. While ISO 14443-3 limits NFC-A to three cascade levels (max 10 bytes for nfcid1), the driver relies on the peer device to signal the end of the cascade. A malicious peer can force additional rounds, appending 3-4 bytes per round and writing past the allocated nfc_target structure. This is reachable via adjacent wireless (NFC) interaction. Patches have been released across multiple stable kernel branches to enforce the NFC_NFCID1_MAXSIZE limit.
Affected products
- Linux Linux Kernel 3.13 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-09: patched: Initial patch authored by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc
- https://git.kernel.org/stable/c/20663102c14566e900e1d2f679e30b7f1694f387
- https://git.kernel.org/stable/c/2819f34e08bdffb6f06a51c67948ec5737fb166a
- https://git.kernel.org/stable/c/46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1
- https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1
- https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba
- https://git.kernel.org/stable/c/9ba6bb09e00b922d902f684f575779e5433fe6e3