Executive brief
The Linux kernel's NFC st21nfca driver processes NFC wireless communication frames without properly validating frame length fields. An attacker within NFC radio range can send a specially crafted frame with a falsified length declaration, causing the kernel to read memory beyond the actual frame data and leak that memory to the attacker, or trigger a denial of service.
Technical details
The vulnerability is an out-of-bounds read in the st21nfca_tm_recv_atr_req() and st21nfca_tm_send_atr_res() functions in drivers/nfc/st21nfca/dep.c. The code validates that the declared atr_req->length field meets a minimum size but fails to check that it does not exceed the actual received frame length (skb->len). When st21nfca_tm_send_atr_res() uses this untrusted length value in a memcpy operation, it reads beyond the buffer boundary. An RF peer within NFC proximity can craft a frame with an inflated length declaration to trigger kernel memory disclosure (exposing data to the attacker) or cause out-of-bounds reads leading to denial of service. The fix adds a bounds check to reject frames where the declared length exceeds the received frame length.
Affected products
- Linux Linux kernel Multiple versions (patched in linux-6.10 and later stable branches)
Timeline
- 2026-09-04: disclosed: CVE-2026-80823 published
- 2026-08-27: patched: Fix commit 0f344944c506b4f02d2b098489f7268b438c369e merged to stable kernel branches