Executive brief
The Linux kernel's NFC microread driver processes Near Field Communication (NFC) target discovery responses from NFC hardware. A flaw in payload validation could allow a malicious or malfunctioning NFC device to cause the kernel to read beyond the bounds of received data, potentially leading to information disclosure or system crash.
Technical details
The vulnerability exists in the microread_target_discovered() function in drivers/nfc/microread/microread.c. The function parses NFC target discovery payloads from socket buffer (skb) data according to the HCI gate type, but validated field offsets and UID copy operations only against the destination nfc_target buffer size, not against the actual length of received data in the skb. An attacker controlling an NFC device could send a malformed discovery response with insufficient payload data, causing out-of-bounds reads. The fix adds length validation checks before each gate-specific payload is processed, ensuring the skb contains sufficient data before accessing fixed field offsets and UID bytes. No CVSS score or evidence of active exploitation was reported.
Affected products
- Linux Linux Kernel multiple versions before patch (see stable tree branches)
Timeline
- 2026-07-23: disclosed
- 2026-08-11: patched
- 2026-09-04: advisory