Cloudanix VulnDB

CVE-2026-80796

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the system reads certain wireless messages could let an attacker peek at parts of the computer's internal memory.

Chainable
Exploitation
Adjacent Network
Attacker needs
Physical Access
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Slab out-of-bounds read in nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() caused by using an unvalidated inner length byte from an NCI RF_INTF_ACTIVATED_NTF to drive memcpy() past the single valid byte supplied in activation_params_len.

Why it matters to the business

Kernel memory disclosure or instability on NFC-enabled Linux systems when processing attacker-controlled wireless packets, with elevated urgency for devices in high-exposure network environments.

How an attack unfolds

An attacker sends a crafted NCI notification with activation_params_len=1 and an inner length byte up to 20 (NFC-A) or 50 (NFC-B) bytes; the two activation-parameter extractors consume the inner length without a remaining-data check and perform an oversized memcpy from the skb, reading adjacent kernel slab memory.

How to fix it

Apply the upstream fix that adds an explicit data_len parameter to both extractor functions, guards the inner length byte, decrements remaining length, and clamps the copy size; update to a kernel containing commit 571dcbeb8e63-equivalent protection for the activation paths.

How to confirm the fix worked

Confirm the patch by inspecting nci.c for the data_len parameter addition and length-clamping logic in the two activation extractors, or replay controlled NCI notifications in a test kernel to verify no out-of-bounds read occurs.

Typical attack path

  1. Obtain local or remote ability to inject NCI RF_INTF_ACTIVATED_NTF frames
  2. Set activation_params_len to a minimal valid value while supplying a larger inner length byte
  3. Trigger the affected extractor functions during interface activation handling
  4. Read kernel memory beyond the skb allocation via the unbounded memcpy

How to detect it

Inspect kernel logs for nfc/nci slab-out-of-bounds warnings or page-faults during RF_INTF_ACTIVATED_NTF processing; correlate with unusual skb lengths in net/nfc traces.

What your security team should do

  • Prioritize kernel updates containing the activation-parameter bounds checks
  • Disable NFC kernel modules if the feature is unused
  • Add kernel memory-safety monitoring around the nfc/nci subsystem

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add data_len bound checks to activation parameter extractors nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() read an inner length byte from the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed kernel buffers, but neither function receives the caller-validated activation_params_len. A crafted NCI notification with activation_params_len=1 and an inner length byte of up to 20 (NFC-A) or 50 (NFC-B) causes memcpy() to read that many bytes past the one valid byte in the activation params region -- a slab out-of-bounds read of kernel memory adjacent to the NCI skb. The sibling nci_extract_rf_params_*() family was given equivalent protection by commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter validation for packet data"), but the two activation parameter extractors were not updated at that time. Add a data_len parameter to both functions, guard against an empty region before consuming the inner length byte, decrement the remaining count after consuming it, and clamp the copy length to what is actually available. Update both call sites to pass ntf.activation_params_len, which is already validated against the skb at ntf.c:801.

Affected packages

Ecosystem Package Introduced Fixed