Executive brief
The Linux kernel's NFC (Near Field Communication) fdp driver contains a buffer overflow vulnerability where a malicious or malfunctioning NFC controller can write arbitrary data to the kernel stack by sending specially crafted packets with invalid length values. Additionally, the driver leaks kernel memory (socket buffer objects) when processing multiple consecutive data packets. An attacker with physical or adjacent network access to an NFC-enabled device could crash the system or potentially execute code at kernel privilege level.
Technical details
The vulnerability exists in the fdp_nci_i2c_read() function in drivers/nfc/fdp/i2c.c. The function reads a 16-bit packet length directly from untrusted device hardware without validation and uses it as a count parameter to i2c_master_recv(), writing into a fixed 261-byte on-stack buffer. A malicious, counterfeit, or malfunctioning NFC controller (or an I2C bus interposer) can specify an out-of-range length value, causing a stack buffer overflow that corrupts the stack canary and return address. Additionally, the packet processing loop allocates socket buffers (skbs) assuming one length packet followed by one data packet; if the device sends consecutive data packets, the second allocation overwrites the pointer without freeing the first skb, causing a memory leak. The fix validates the length against FDP_NCI_I2C_MIN_PAYLOAD and FDP_NCI_I2C_MAX_PAYLOAD bounds and properly frees previously allocated skbs before reallocation. The patch has been committed to the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions; patch available in stable tree
Timeline
- 2026-09-04: disclosed: CVE-2026-80802 published on NVD
- 2026-08-27: patched: Patch committed to Linux kernel stable tree by Greg Kroah-Hartman