Cloudanix VulnDB

CVE-2026-80799

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A nearby device can send specially crafted wireless data that crashes or reads memory inside the Linux kernel on NFC-enabled systems.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

OOB reads and integer wrap in TLV parsers allow reading past buffer bounds or looping indefinitely when processing remote LLCP general bytes.

Why it matters to the business

Systems using NFC may crash, leak memory contents, or become unstable when receiving malformed data from nearby devices, with higher urgency for devices that keep NFC enabled by default.

How an attack unfolds

An attacker brings a malicious NFC device or tag within range; the kernel receives the crafted general bytes via nfc_llcp_set_remote_gb and passes them to the vulnerable parsers without authentication or prior validation, triggering the offset wrap or out-of-bounds reads.

How to fix it

Upgrade to a kernel containing the fix that widens the offset variable to u16 and adds the required header and value bounds checks before every TLV access.

How to confirm the fix worked

Confirm the patch is present by inspecting the source of nfc_llcp_parse_gb_tlv and nfc_llcp_parse_connection_tlv for u16 offset and the two bounds checks; test with a short or truncated TLV buffer to verify no crash or wrap occurs.

Typical attack path

  1. Attacker positions malicious NFC transmitter near target
  2. Kernel NFC stack receives LLCP general bytes containing crafted TLVs
  3. nfc_llcp_set_remote_gb calls the TLV parsers with attacker-controlled length and data
  4. u8 offset wraps or missing bounds checks cause OOB read or infinite loop
  5. Resulting memory corruption or denial of service occurs in kernel context

How to detect it

Look for kernel oops or panic logs containing the NFC LLCP parse functions, repeated invocations of nfc_llcp_set_remote_gb with unusual TLV lengths, or unexpected memory reads near the NFC driver; correlate with physical proximity events if NFC logs are enabled.

What your security team should do

  • Apply the corrected kernel version as soon as vendor packages become available
  • Disable NFC interfaces on systems that do not require them
  • Monitor for upstream backports to long-term supported kernel branches

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data advances offset past 255 it silently wraps to zero, causing infinite loops or double-processing of buffer data. 2. Before reading tlv[0] (type) and tlv[1] (length) there is no check that offset+2 <= tlv_array_len. A truncated TLV causes an OOB read of one byte past the buffer end. 3. After reading the length field, the value bytes are accessed without checking offset+2+length <= tlv_array_len. A crafted length=0xFF on a short buffer causes up to 255 bytes of OOB read past the buffer end. Both functions are reachable without authentication via nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes directly into nfc_llcp_parse_gb_tlv() with no additional validation. Fix all three issues by widening offset from u8 to u16 and adding bounds checks for both the TLV header and value field before each access.

Affected packages

Ecosystem Package Introduced Fixed