Executive brief
A vulnerability in the Linux kernel's Near Field Communication (NFC) subsystem could allow an attacker to access sensitive information or cause a system crash. The issue stems from how the system validates data packets sent from NFC chips, which can lead to the processing of uninitialized memory. This affects devices using NCI-based NFC hardware, potentially impacting data privacy and system stability.
Technical details
A vulnerability exists in the net/nfc/nci component of the Linux kernel due to improper parameter validation for packet data. A previous attempt to fix uninitialized data access (commit 9c328f54741b) incorrectly compared variable-length data packets against fixed-size structures using sizeof(). This logic error can be exploited by an attacker in close proximity (adjacent) to send malformed NCI packets that bypass length checks. This results in out-of-bounds reads or access to uninitialized kernel memory, potentially leading to information disclosure or a kernel oops. The fix involves implementing proper offset-based length validation for variable-length NCI notification packets.
Affected products
- Linux Linux kernel All versions since commit 9c328f54741b
Timeline
- 2026-02-18: other: Patch submitted by Michael Thalmeier
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/3b91160e9a91b5a2662875417dc42dc5b0bf03ea
- https://git.kernel.org/stable/c/498fc5d0d650c77e87fcc73808d4f43240c21805
- https://git.kernel.org/stable/c/571dcbeb8e635182bb825ae758399831805693c2
- https://git.kernel.org/stable/c/a24a8a582da4426b2042e510a1080df84083b51d
- https://git.kernel.org/stable/c/ad058a4317db7fdb3f09caa6ed536d24a62ce6a0
- https://git.kernel.org/stable/c/c692db813a7e3b7c3c17d6e9a3ad2a018bf1142b
- https://git.kernel.org/stable/c/f5218426f765eee22e178df9c126d974792fb6a5