Executive brief
The Linux kernel's NFC (Near Field Communication) subsystem contains a buffer parsing vulnerability in LLCP (Logical Link Control Protocol) handling. An attacker with a nearby NFC device can trigger out-of-bounds memory reads and potential denial of service without authentication, as LLCP link activation occurs automatically after NFC-DEP discovery.
Technical details
The vulnerability exists in the nfc_llcp_recv_snl() function in net/nfc/llcp_core.c, which parses SNL (Service Name List) TLV (Type-Length-Value) structures. The function had three critical flaws: (1) integer underflow in tlv_len for frames shorter than LLCP_HEADER_SIZE, (2) missing bounds checks when reading per-TLV headers (type and length bytes), and (3) insufficient validation of declared TLV lengths, combined with underflow in service_name_len calculations for SDREQ/SDRES TLV types. An attacker can craft a malicious NFC frame to trigger out-of-bounds reads. The fix adds pointer-based TLV iteration bounded by skb_tail_pointer() and explicit length validation for SDREQ (minimum 1 byte) and SDRES (exactly 2 bytes). The patch is already merged upstream and available in stable kernels.
Affected products
- Linux Linux kernel Multiple versions prior to patch (linux-2.6.11 through linux-6.x; exact affected range spans multiple stable branches)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-06-09: patched: Upstream patch commit f4c7f37f0ab990952539dc68d931d65c3657600a submitted by Doruk Tan Ozturk
- 2026-09-14: other: Patch merged into stable kernel releases