Executive brief
The Linux kernel's NFC (Near-Field Communication) subsystem contains a vulnerability in how it parses device initialization responses. Attackers can send malformed NFC protocol messages that declare incorrect data lengths, causing the kernel to read uninitialized memory. This could lead to information disclosure or trigger denial-of-service conditions on systems using NFC.
Technical details
The vulnerability is an uninitialized memory read (CWE-908) in the nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() functions in net/nfc/nci/rsp.c. These functions parse CORE_INIT_RSP packets without validating that the socket buffer (skb) contains sufficient data before accessing packet fields. A malformed or injected response can declare a large num_supported_rf_interfaces count while providing insufficient data, causing out-of-bounds reads into uninitialized slab memory. This was detected by KMSAN (Kernel Memory Sanitizer) during parsing. The fix adds length validation checks before accessing each packet field, including status, fixed-size headers, and variable-length rf_interface arrays. The vulnerability affects all Linux kernel versions with NCI 2.x support and is fixed via bounds-checking in net/nfc/nci/rsp.c.
Affected products
- Linux Linux kernel Versions with NFC/NCI support and NCI 2.x initialization (prior to fix commit d56575a2595ee1f597f39e8a1cfb67ed3501678d)
Timeline
- 2026-05-27: other: Patch authored by Yun Zhou
- 2026-09-14: disclosed: Merged into stable kernel by Greg Kroah-Hartman
- 2026-09-17: disclosed: Published on NVD