Executive brief
The Linux kernel contains a memory safety bug in its NFC (Near-Field Communication) subsystem that can cause a denial-of-service crash or potential code execution. An NFC device that repeatedly reports newly activated targets without proper list management can trigger memory corruption that overwrites adjacent kernel memory, destabilizing the system.
Technical details
The vulnerability is a slab out-of-bounds write in nci_target_auto_activated() within the NFC NCI driver. The function appends targets to a fixed-size array (ndev->targets[NCI_MAX_DISCOVERED_TARGETS]) without checking if the array is full before incrementing ndev->n_targets. When an NFCC device repeatedly sends RF discovery responses without clearing the target list, followed by auto-activated target notifications, the n_targets counter exceeds the array bounds. This causes a struct nfc_target to be written past the allocated buffer, corrupting adjacent kernel memory. The attack requires control over an NFC device or proximity to trigger malicious NFC messages; no authentication is needed. The fix adds a bounds check matching the sibling function nci_add_new_target().
Affected products
- Linux Linux kernel various (prior to fix)
Timeline
- 2026-09-04: disclosed