Cloudanix VulnDB

CVE-2026-80795

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel handles NFC device discovery can let specially crafted hardware messages corrupt memory and crash the system or allow deeper attacks.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in nci_target_auto_activated() when appending to the fixed-size ndev->targets array without checking n_targets against NCI_MAX_DISCOVERED_TARGETS, followed by nfc_targets_found() walking the inflated count, resulting in a slab out-of-bounds write.

Why it matters to the business

Kernel memory corruption on systems using NFC that can lead to crashes, instability, or potential privilege escalation; urgent patching required on devices handling NFC discovery even with low exploitation probability.

How an attack unfolds

An attacker with control of an NFCC repeatedly issues RF_DISCOVER_RSP to re-enter NCI_DISCOVERY without clearing the target list via nci_clear_target_list(), then sends RF_INTF_ACTIVATED_NTF to trigger nci_target_auto_activated() which writes past the array bounds during nci_rx_work processing.

How to fix it

Apply the upstream kernel patch that adds the missing n_targets bounds check in nci_target_auto_activated() identical to the check in nci_add_new_target(); rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the nci_target_auto_activated() function for the bounds guard; recompile with KASAN and exercise repeated NCI discovery sequences to verify no slab-out-of-bounds reports occur.

Typical attack path

  1. Gain ability to inject NCI notifications from an NFCC or equivalent hardware/firmware
  2. Send repeated RF_DISCOVER_RSP packets to re-enter discovery state without target list reset
  3. Deliver RF_INTF_ACTIVATED_NTF causing nci_target_auto_activated() to overflow the targets array
  4. Trigger nfc_targets_found() to dereference corrupted kernel memory

How to detect it

Search kernel logs for KASAN slab-out-of-bounds reports referencing nci_add_new_protocol, nci_ntf_packet, or nci_rx_work; correlate with NFC controller firmware logs showing repeated RF_DISCOVER_RSP followed immediately by RF_INTF_ACTIVATED_NTF without intervening nci_clear_target_list calls.

What your security team should do

  • Prioritize kernel updates on all Linux systems exposing NFC interfaces
  • Monitor for kernel oops or KASAN reports involving nci_rx_work and nci_add_new_protocol
  • Disable NFC kernel modules on systems where NFC is not required

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in nci_target_auto_activated() nci_target_auto_activated() appends a target to the fixed-size array ndev->targets[NCI_MAX_DISCOVERED_TARGETS] and increments ndev->n_targets without first checking the array is full; unlike its sibling nci_add_new_target(), which bails out when n_targets already equals NCI_MAX_DISCOVERED_TARGETS. ndev->n_targets is only cleared by nci_clear_target_list(), so an NFCC that repeatedly re-runs discovery (RF_DISCOVER_RSP, which re-enters NCI_DISCOVERY without clearing the target list) and reports an auto-activated target (RF_INTF_ACTIVATED_NTF) drives n_targets past the limit. The append then writes a struct nfc_target past the end of the array (a slab out-of-bounds write), and nfc_targets_found() goes on to walk the array with the inflated count: BUG: KASAN: slab-out-of-bounds in nci_add_new_protocol+0x94/0x2ac [nci] Write of size 2 at addr ffff0000c7299a18 by task kworker/u8:0/12 Workqueue: nfc0_nci_rx_wq nci_rx_work [nci] Call trace: nci_add_new_protocol+0x94/0x2ac [nci] nci_ntf_packet+0xddc/0x11a0 [nci] nci_rx_work+0x15c/0x1e0 [nci] process_one_work+0x2dc/0x500 worker_thread+0x240/0x460 kthread+0x1c0/0x1d0 ret_from_fork+0x10/0x20 The buggy address belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1024 bytes to the right of allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618) Guard nci_target_auto_activated() with the same check used by nci_add_new_target().

Affected packages

Ecosystem Package Introduced Fixed