Cloudanix VulnDB

CVE-2026-80823

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A nearby attacker can trick a device into sending back pieces of its internal memory or make it stop working by sending a specially crafted wireless message over near-field communication.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing length validation in st21nfca_tm_recv_atr_req allows an attacker-controlled atr_req->length larger than skb->len, causing memcpy in st21nfca_tm_send_atr_res to perform an out-of-bounds read of kernel memory that is then returned in the ATR_RES response.

Why it matters to the business

Local proximity attackers can disclose kernel memory or trigger denial of service on NFC-enabled Linux systems; the low EPSS and lack of known exploitation reduce immediate urgency but the issue remains in unpatched kernels used in embedded and mobile devices.

How an attack unfolds

An attacker with an NFC device in close proximity sends a malformed ATR_REQ frame declaring a length exceeding the actual frame bytes; the kernel trusts the declared length, reads past the received buffer, and copies the resulting data into the outgoing ATR_RES, disclosing kernel memory or causing a crash on larger overreads.

How to fix it

Apply the upstream kernel patch that rejects ATR_REQ frames whose declared length exceeds skb->len; rebuild and deploy updated kernels containing the fix for the st21nfca driver.

How to confirm the fix worked

Confirm the patch is present by inspecting the st21nfca_tm_recv_atr_req function for an explicit length check against skb->len before using atr_req->length; test with crafted short frames that declare excessive length and verify they are dropped.

Typical attack path

  1. Position NFC-capable hardware within proximity of the target
  2. Transmit a short ATR_REQ frame with an inflated length field
  3. Trigger st21nfca_tm_recv_atr_req and subsequent memcpy
  4. Receive ATR_RES containing out-of-bounds kernel bytes or observe crash

How to detect it

Review kernel logs for oops or panic messages originating from st21nfca_tm_send_atr_res or memcpy calls during NFC ATR exchange; inspect audit or system logs for unexpected NFC activation events on systems that should not expose the interface.

What your security team should do

  • Prioritize patching Linux kernels on systems exposing NFC interfaces
  • Monitor upstream stable and distribution kernels for the st21nfca length-validation fix
  • Disable NFC hardware or the st21nfca driver where proximity communication is not required

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATR_REQ length against the received frame st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at least ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req->length is at least sizeof(struct st21nfca_atr_req), but never checks that atr_req->length does not exceed the actual received length (skb->len). st21nfca_tm_send_atr_res() then trusts the declared length: gb_len = atr_req->length - sizeof(struct st21nfca_atr_req); ... memcpy(atr_res->gbi, atr_req->gbi, gb_len); so an RF peer that sends a short frame but sets atr_req->length larger than the frame makes gb_len exceed the general bytes actually present, and the memcpy reads out of bounds past the received skb. Those bytes are placed in the ATR_RES and sent back to the peer (kernel-memory disclosure to a proximity attacker); a larger declared length is an out-of-bounds read (DoS). Reject frames whose declared length exceeds the received length. The adjacent nfc_tm_activated() path in the same function already derives its general-bytes length from skb->len rather than the declared field. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.

Affected packages

Ecosystem Package Introduced Fixed