Executive brief
The Linux kernel's NFC (Near Field Communication) subsystem contains a memory validation bug in the NCI protocol handler. When processing NFC activation notifications, two functions fail to properly validate buffer lengths before copying data, allowing an attacker to read kernel memory adjacent to network buffers. This could expose sensitive kernel data or aid in bypassing security mechanisms.
Technical details
The vulnerability is a slab out-of-bounds read in the NFC NCI driver's activation parameter extraction functions: `nci_extract_activation_params_iso_dep()` and `nci_extract_activation_params_nfc_dep()`. These functions read an inner length byte from the RF_INTF_ACTIVATED_NTF payload and use it to control a memcpy() into fixed kernel buffers without validating that sufficient data is available. A crafted NCI notification with `activation_params_len=1` and an inner length byte of up to 20 (NFC-A) or 50 (NFC-B) causes memcpy() to read far beyond the allocated region. The fix adds bounds checking via a `data_len` parameter, validates data availability before consuming length bytes, and clamps copy lengths to actual available data. The vulnerability requires local NFC device access or network-reachable NFC emulation.
Affected products
- Linux Linux kernel Affected versions include numerous stable branches; patch commits 0428fa2c22e2ba0cff766d3b80d461e149102045 and 04e51353cb9fa321caaeeed8331d4cd041fbaca7
Timeline
- 2026-09-04: disclosed
- 2026-06-12: patched: Upstream fix commit 0428fa2c22e2ba0cff766d3b80d461e149102045