CVE-2022-26490

What it actually does

Buffer overflow in st21nfca_connectivity_event_received due to untrusted length fields in EVT_TRANSACTION processing, allowing local memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can achieve arbitrary code execution and full system compromise, impacting device integrity and requiring urgent kernel updates across fleets with NFC hardware.

How an attack unfolds

An attacker with local access crafts malicious NFC connectivity events containing oversized length parameters that overflow the EVT_TRANSACTION buffer in the st21nfca driver, leading to memory corruption and potential privilege escalation.

How to fix it

Upgrade the Linux kernel to a version containing commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 or later; disable the st21nfca driver if NFC is not required.

How to confirm the fix worked

Verify the running kernel includes commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 or a backported equivalent; test NFC event handling under controlled oversized input to confirm absence of overflow.

Typical attack path

1. Obtain local user access on a vulnerable Linux system with the st21nfca NFC driver enabled
2. Trigger or inject a crafted EVT_TRANSACTION event via the NFC subsystem
3. Exploit the unchecked length parameters to overflow the buffer and corrupt memory
4. Achieve arbitrary code execution or kernel-level control

How to detect it

Review kernel logs and NFC subsystem traces for anomalous EVT_TRANSACTION events or buffer-related warnings; correlate with local process activity attempting to interact with /dev/nfc or st21nfca interfaces.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected systems within standard patch windows
• Audit systems for st21nfca driver usage and restrict NFC hardware where possible
• Monitor for new local privilege-escalation attempts targeting kernel NFC paths
• Apply compensating controls such as kernel hardening features until patches are deployed