Executive brief
A vulnerability in the Linux kernel's NFC LLCP socket implementation allows a local attacker to write past the bounds of a user-space buffer when calling getsockopt with an invalid option length. This could result in memory corruption or information disclosure on systems with NFC capabilities enabled.
Technical details
The vulnerability exists in nfc_llcp_getsockopt() in net/nfc/llcp_sock.c, where the function casts optval to (u32 __user *) and uses put_user() to write 4 bytes unconditionally, regardless of the caller-supplied optlen parameter. The existing length clamping logic only adjusts the reported length, not the actual write size. A local attacker calling getsockopt with optlen < 4 bytes causes the kernel to write past the user-space buffer, violating the standard getsockopt(2) contract. The fix adds explicit validation to reject any call with optlen < sizeof(u32), including a negative value check to prevent integer promotion attacks. This is a local attack requiring the ability to make socket syscalls on a system with NFC LLCP support enabled.
Affected products
- Linux Linux kernel all versions prior to fix (commit 99985bfa8336fadcc69190ba2dcbd5386af3d661)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-09-14: patched: Fix committed to stable kernel trees