Executive brief
The Linux kernel's NFC (Near Field Communication) LLCP protocol implementation fails to validate the minimum size of incoming protocol data units before processing them. An attacker within NFC proximity can send a malformed packet that causes the kernel to read memory far beyond the packet boundary, potentially exposing sensitive kernel data or causing a denial of service. No authentication is required; this can be triggered automatically when an NFC device comes into range.
Technical details
The vulnerability is an out-of-bounds read in the NFC LLCP receive path (net/nfc/llcp_core.c). The root cause is that nfc_llcp_rx_skb() dereferences packet data (pdu->data[0] and pdu->data[1]) without first verifying that the received skb is at least LLCP_HEADER_SIZE (2 bytes) long. For CONNECT or CC PDUs, the code then computes tlv_array_len = skb->len - LLCP_HEADER_SIZE as an unsigned type, causing integer underflow when the frame is shorter than 2 bytes; this wraps to a huge value, causing the subsequent TLV walk to read far past the buffer end. The attack vector is network-adjacent (NFC proximity); LLCP link activation occurs automatically after NFC-DEP without authentication. The fix adds a pskb_may_pull() check in __nfc_llcp_recv() to drop undersized frames before processing.
Affected products
- Linux Linux kernel affected versions include at least 2.6.11 through 6.x (see stable backports across all listed branches; original introduced by commit d646960f7986)
Timeline
- 2026-09-04: disclosed: Published to NVD
- 2026-08-11: patched: Upstream fix applied (commit 95674f506c6376d6722a23144c9acd26609771ed)
- 2026-08-27: patched: Backported to stable tree (commit 3793d768b40f38bb97265dd5b9a8b8655c4e1b1d)