Executive brief
The Linux kernel's NFC (Near Field Communication) subsystem contains bugs in parsing LLCP (Logical Link Control Protocol) TLV (Tag-Length-Value) data structures. An attacker can send specially crafted NFC messages that trigger out-of-bounds memory reads, potentially leaking sensitive kernel data or causing system crashes. No authentication is required; the vulnerable code is reachable directly from remote NFC device communications.
Technical details
The vulnerability involves three related bugs in nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() in net/nfc/llcp_commands.c: (1) an offset counter is declared as u8 while tlv_array_len is u16, allowing the offset to wrap at 255 bytes and cause infinite loops or double-processing; (2) no bounds check before reading the TLV type and length fields (first 2 bytes), enabling a one-byte OOB read on truncated data; (3) no bounds check after reading the length field before accessing value bytes, allowing up to 255 bytes of OOB read with a crafted length=0xFF. The functions are reachable without authentication via nfc_llcp_set_remote_gb(), which passes remote LLCP general bytes directly. The fix widens offset from u8 to u16 and adds bounds checks before all buffer accesses. Patches are available in the Linux stable kernel tree.
Affected products
- Linux Linux kernel all versions with vulnerable NFC LLCP parsing code
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: Patch commits 2c1456fe09ab1a5a9fe1d8339ca6d509589b56e1 and 2d239590d1845a706304833d40dd6d4fec20ad88 in stable kernel tree