Executive brief
The Linux kernel's NFC LLCP subsystem contains an out-of-bounds memory read vulnerability in TLV (Type-Length-Value) message parsing. An attacker with an NFC device in proximity can send specially crafted CONNECT or CC frames to trigger the flaw, potentially exposing sensitive kernel memory or crashing the system. This affects any Linux device with NFC support enabled.
Technical details
The vulnerability exists in the nfc_llcp_connect_sn() function, which parses TLV-encoded service names without proper bounds checking. The parser walks a TLV list by reading a two-byte header (type and length) followed by value bytes, but fails to validate that either the header or the declared length stays within the buffer boundaries. Additionally, the tlv_array_len is calculated as a size_t subtraction (skb->len - LLCP_HEADER_SIZE), causing an integer underflow for frames shorter than the LLCP header and enabling an out-of-bounds read. The function is reachable from received CONNECT and CC PDUs via nfc_llcp_recv_connect() and nfc_llcp_recv_cc(); NFC LLCP link activation occurs automatically after NFC-DEP without requiring authentication. The fix bounds the TLV walk to skb_tail_pointer(skb) and validates each declared length before use, matching prior fixes for similar parsers.
Affected products
- Linux Linux kernel versions prior to the fix
Timeline
- 2026-09-04: disclosed