Executive brief
The Linux kernel's NFC (Near Field Communication) digital technology driver contains a buffer overflow vulnerability in its handling of NFC-F device responses. A malicious NFC-F device can send an oversized response that overflows a stack-local buffer, potentially allowing an attacker within NFC proximity to crash the system or execute code with kernel privileges.
Technical details
The vulnerability is a stack buffer overflow in the digital_in_recv_sensf_res() function in net/nfc/digital_technology.c. The function performs a memcpy() of resp->len bytes from a remote NFC-F device response into a fixed-size NFC_SENSF_RES_MAXSIZE-byte buffer (target.sensf_res field of a stack-local nfc_target struct) without validating that resp->len does not exceed the destination buffer size. An attacker with a malicious NFC-F device within communication range can send an oversized SENSF_RES response to trigger the overflow. The fix clamps resp->len to NFC_SENSF_RES_MAXSIZE using min_t() before the memcpy() operation. Patches have been committed upstream and to stable kernel branches.
Affected products
- Linux Linux kernel All versions supporting NFC digital technology (from kernel version with commit 8c0695e4998d onwards)
Timeline
- 2026-09-04: disclosed: Vulnerability published
- 2026-08-27: patched: Patch merged to stable kernel (commit 31aa28ed732f66ab83c40ef53d99791be69b85c4)
- 2026-08-11: patched: Patch merged upstream (commit 344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16)