CVE-2026-80802nfc: fdp: bound the device-reported read length and fix an skb leak
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdp_nci_i2c_read() takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2c_master_recv() count into a 261-byte on-stack buffer: a malicious, counterfeit or malfunctioning controller (or an i2c bus interposer) can drive it far past the buffer for a stack out-of-bounds write that clobbers the canary and return address, or below the minimum frame size (directly, or by truncating the computed sum) so the header/LRC strip and the next length read run past a short receive. Reject a length outside [FDP_NCI_I2C_MIN_PAYLOAD, FDP_NCI_I2C_MAX_PAYLOAD], as a corrupted packet already is, and force resynchronization. The same loop allocates one data skb per iteration and assumes a length packet followed by a data packet; a device that sends two data packets in one call leaks the first skb when the second allocation overwrites it. Free a previously allocated skb before allocating the next.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a06347c04c13e380afce0c9816df51f00b83faf1 before d9498ab9a78cb63d78dbe4f221d8cc6c91f285ee; from a06347c04c13e380afce0c9816df51f00b83faf1 before 1fc32327b927a6e2cde086f82575c29880844228; from a06347c04c13e380afce0c9816df51f00b83faf1 before 8d2c243b79854628ff076c38748c020042f02f57; from a06347c04c13e380afce0c9816df51f00b83faf1 before fc3c2bd5b1ec6c7cbc8a50e32d9bcec114f25463; from a06347c04c13e380afce0c9816df51f00b83faf1 before 0d723090645b82c1cb27cfd7ebf81f0e7c96bcae; from a06347c04c13e380afce0c9816df51f00b83faf1 before db7e464b350969c6ea8340de00d9796e5fd5123b; from a06347c04c13e380afce0c9816df51f00b83faf1 before e5eec121f2c3bc4c7022613bedd9121a8aa4c949; from a06347c04c13e380afce0c9816df51f00b83faf1 before 1aa3fc769b0c45bd19f8dab1697084c2b3f6d706; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/d9498ab9a78cb63d78dbe4f221d8cc6c91f285ee
- https://git.kernel.org/stable/c/1fc32327b927a6e2cde086f82575c29880844228
- https://git.kernel.org/stable/c/8d2c243b79854628ff076c38748c020042f02f57
- https://git.kernel.org/stable/c/fc3c2bd5b1ec6c7cbc8a50e32d9bcec114f25463
- https://git.kernel.org/stable/c/0d723090645b82c1cb27cfd7ebf81f0e7c96bcae
- https://git.kernel.org/stable/c/db7e464b350969c6ea8340de00d9796e5fd5123b
- https://git.kernel.org/stable/c/e5eec121f2c3bc4c7022613bedd9121a8aa4c949
- https://git.kernel.org/stable/c/1aa3fc769b0c45bd19f8dab1697084c2b3f6d706
- https://git.kernel.org/stable/c/7ad21dcfeb5181af0c3ee2608808c0c0a5283aa1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.