Cloudanix VulnDB

CVE-2026-80801

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the system reads data from certain wireless cards could let an attacker crash the machine or access memory it should not.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing length validation on skb data in microread_target_discovered allows reads or copies of fixed fields and UID bytes beyond the actual payload length received from the HCI gate.

Why it matters to the business

Kernel crashes or memory corruption in NFC-enabled Linux systems can cause device instability, denial of service, or potential information disclosure when handling discovery responses from contactless cards or readers.

How an attack unfolds

An attacker supplies a crafted or truncated target discovery payload through an NFC interface; the driver parses it using fixed offsets without checking the skb length first, resulting in out-of-bounds access during field reads or UID copies.

How to fix it

Apply the upstream kernel patch that adds explicit payload length validation before accessing fixed fields and copying UIDs in microread_target_discovered; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the microread driver source for the added skb length checks against gate-specific payload sizes; test with deliberately truncated discovery payloads to verify no out-of-bounds access occurs.

Typical attack path

  1. Attach or present a malicious NFC target or emulator to the affected system
  2. Trigger target discovery via the microread HCI gate
  3. Supply a payload shorter than the expected fixed fields plus UID length
  4. Driver performs unchecked reads or memcpy operations leading to kernel memory corruption or crash

How to detect it

Review kernel logs for oops or panic entries mentioning microread_target_discovered or nfc; inspect skb handling paths in NFC discovery events for signs of unexpected truncation.

What your security team should do

  • Prioritize kernel updates on any systems exposing NFC interfaces
  • Disable NFC kernel modules where the feature is not required
  • Monitor for kernel oops or panic logs related to the nfc microread driver
  • Apply the fix before the next scheduled maintenance window given the 25-day publication window

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate. The fixed field offsets and UID copies were checked only against the destination nfc_target buffers, not against the actual skb length. Validate that each gate-specific payload contains the fixed fields and UID bytes before reading or copying them.

Affected packages

Ecosystem Package Introduced Fixed