« Volver al listado

CVE-2026-80798

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: reject PDUs shorter than the LLCP header

Every LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the receive path never checked that a frame is at least LLCP_HEADER_SIZE bytes before parsing it.

nfc_llcp_rx_skb() reads the header via nfc_llcp_ptype()/nfc_llcp_dsap()/ nfc_llcp_ssap(), which dereference pdu->data[0] and pdu->data[1], and a CONNECT or CC PDU then computes

as a size_t and hands it to the TLV walk. When the frame is shorter than the header the subtraction wraps to a huge value and the walk runs far past the buffer, an out-of-bounds read.

Leer descripción completaMostrar menos

A nearby NFC device can reach this without authentication; LLCP link activation happens automatically after NFC-DEP.

Guard the common receive choke point __nfc_llcp_recv(), shared by both the target (nfc_llcp_data_received()) and initiator (nfc_llcp_recv()) paths, so a short skb is dropped before the rx_work worker parses it. Use pskb_may_pull() rather than a skb->len test so the two header bytes are guaranteed to sit in the skb linear area even for a non-linear skb, matching how the sibling NCI and HCI receive paths validate their headers.

Reproduced with a KFENCE out-of-bounds read via /dev/virtual_nci on linux-next.

Found by 0sec automated security-research tooling (https://0sec.ai).

Detalles técnicos trazas, registros y código del informe original
	tlv_array_len = skb->len - LLCP_HEADER_SIZE;

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80798",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "f36cffea24bf3e2cc29a00d4b51dbcadc087d810",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "a7b9b449f5a5132221fff6adc11a9431ab8cd914",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "3793d768b40f38bb97265dd5b9a8b8655c4e1b1d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "eab47618e282602197db287ecbd1b09d356a2515",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "e969e98410051b1ef8cc318bfe0c7e3f24ec766d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "ae5f20f5842f440b72d030e3a34fe182dd8eae42",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "d3d90243393c48146911c67fd3792b549d21d9e6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
              "lessThan": "95674f506c6376d6722a23144c9acd26609771ed",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/nfc/llcp_core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/nfc/llcp_core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-04T16:18:06.487",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3793d768b40f38bb97265dd5b9a8b8655c4e1b1d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/95674f506c6376d6722a23144c9acd26609771ed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a7b9b449f5a5132221fff6adc11a9431ab8cd914",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ae5f20f5842f440b72d030e3a34fe182dd8eae42",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3d90243393c48146911c67fd3792b549d21d9e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e969e98410051b1ef8cc318bfe0c7e3f24ec766d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eab47618e282602197db287ecbd1b09d356a2515",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f36cffea24bf3e2cc29a00d4b51dbcadc087d810",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: reject PDUs shorter than the LLCP header\n\nEvery LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the\nreceive path never checked that a frame is at least LLCP_HEADER_SIZE bytes\nbefore parsing it.\n\nnfc_llcp_rx_skb() reads the header via nfc_llcp_ptype()/nfc_llcp_dsap()/\nnfc_llcp_ssap(), which dereference pdu->data[0] and pdu->data[1], and a\nCONNECT or CC PDU then computes\n\n\ttlv_array_len = skb->len - LLCP_HEADER_SIZE;\n\nas a size_t and hands it to the TLV walk. When the frame is shorter than\nthe header the subtraction wraps to a huge value and the walk runs far\npast the buffer, an out-of-bounds read.\n\nA nearby NFC device can reach this without authentication; LLCP link\nactivation happens automatically after NFC-DEP.\n\nGuard the common receive choke point __nfc_llcp_recv(), shared by both the\ntarget (nfc_llcp_data_received()) and initiator (nfc_llcp_recv()) paths, so\na short skb is dropped before the rx_work worker parses it. Use\npskb_may_pull() rather than a skb->len test so the two header bytes are\nguaranteed to sit in the skb linear area even for a non-linear skb,\nmatching how the sibling NCI and HCI receive paths validate their headers.\n\nReproduced with a KFENCE out-of-bounds read via /dev/virtual_nci on\nlinux-next.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
    }
  ],
  "lastModified": "2026-09-04T16:18:06.487",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}