Cloudanix VulnDB

CVE-2026-80803

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A nearby wireless device could send too much data and break the part of the operating system that talks to such devices, potentially crashing the machine or letting an attacker take control.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Remote Code Execution
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing length validation in digital_in_recv_sensf_res allows memcpy of an attacker-controlled resp->len into the fixed-size stack buffer target.sensf_res, overflowing the enclosing nfc_target structure.

Why it matters to the business

Systems with NFC enabled (embedded, mobile, IoT, automotive) face kernel memory corruption that can produce crashes or local code execution; low exploitability and absence from KEV reduce immediate enterprise-wide risk but still require patching of any Linux kernel using the NFC digital driver.

How an attack unfolds

An attacker brings a malicious NFC-F tag or reader within range, forces the kernel to perform an SENSF_RES exchange, and replies with a response whose len field exceeds NFC_SENSF_RES_MAXSIZE; the unchecked copy then corrupts adjacent stack data in struct nfc_target.

How to fix it

Apply the upstream fix that clamps resp->len to NFC_SENSF_RES_MAXSIZE before the copy; rebuild and deploy the patched kernel on all systems that enable CONFIG_NFC. If NFC is unused, compile the kernel without NFC support or blacklist the nfc_digital module.

How to confirm the fix worked

Confirm the presence of the length clamp in digital_in_recv_sensf_res in the running kernel source or verify that the distro kernel changelog lists the correction; test by sending an oversized SENSF_RES frame in a lab environment and observing that the copy is now bounded.

Typical attack path

  1. Position malicious NFC-F device near target hardware
  2. Trigger NFC discovery that invokes digital_in_recv_sensf_res
  3. Transmit SENSF_RES frame with oversized len value
  4. memcpy overflows stack-local nfc_target structure
  5. Achieve memory corruption leading to crash or controlled execution

How to detect it

Review kernel logs for oops or panic messages referencing nfc_target or digital_in_recv_sensf_res; inspect NFC traffic captures for SENSF_RES frames whose reported length exceeds the expected maximum.

What your security team should do

  • Inventory all Linux systems with NFC hardware or the nfc_digital module loaded
  • Prioritize kernel updates on devices where NFC is required; disable NFC via kernel config or module blacklist where it is not
  • Monitor EPSS and KEV status for any future rise in exploit activity
  • Include NFC stack in regular kernel update cadence even though current EPSS remains low

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target. Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy. Found by 0sec automated security-research tooling (https://0sec.ai).

Affected packages

Ecosystem Package Introduced Fixed