CVE-2026-80794 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() each parse a notification into an on-stack struct (nci_rf_discover_ntf / nci_rf_intf_activated_ntf) that is not initialised. The RF technology-specific parameters are only extracted when rf_tech_specific_params_len is non-zero, so a notification that reports a zero length leaves the rf_tech_specific_params union uninitialised - and both handlers then pass it to nci_add_new_protocol(), which reads it:
- discover: nci_add_new_target() -> nci_add_new_protocol(); - activated: nci_target_auto_activated() -> nci_add_new_protocol().
nci_add_new_protocol() uses nfca_poll->nfcid1_len as both a branch condition and a memcpy() length and copies nfcid1/sens_res/sel_res into ndev->targets, which is later exposed to user space via NFC_CMD_GET_TARGET.
BUG: KMSAN: uninit-value in nci_add_new_protocol+0x624/0x6c0 nci_add_new_protocol+0x624/0x6c0 nci_ntf_packet+0x25b2/0x3c30 nci_rx_work+0x318/0x5d0 process_scheduled_works+0x84b/0x17a0 worker_thread+0xc10/0x11b0 kthread+0x376/0x500 Local variable ntf.i created at: nci_ntf_packet+0xbc2/0x3c30
Zero-initialise both on-stack notifications so the union reads back as zero when no technology-specific parameters are present.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's Near Field Communication subsystem contains a critical information disclosure vulnerability within the NCI protocol implementation, specifically affecting the RF discovery and interface activated notification handlers. This flaw arises from improper initialization of on-stack data structures used to parse incoming NFC notifications. When the nci_rf_discover_ntf_packet or nci_rf_intf_activated_ntf_packet functions process an incoming notification, they allocate a local structure such as nci_rf_discover_ntf or nci_rf_intf_activated_ntf without zeroing out its memory contents. The code logic only populates specific fields within these structures when the rf_tech_specific_params_len field indicates that technology-specific parameters are present and have non-zero length. Consequently, if a remote NFC device sends a notification with a parameter length of zero, critical union members remain uninitialized, retaining whatever data previously existed in that stack memory location.
The operational impact is severe because these partially initialized structures are subsequently passed to the nci_add_new_protocol function for further processing and storage. This function relies on fields such as nfca_poll->nfcid1_len not only as a conditional branch but also as the length argument for memcpy operations. Because the underlying memory was never cleared, the kernel may copy arbitrary stack contents into the device's target list structure ndev->targets. These targets are then exposed to user space applications through the NFC_CMD_GET_TARGET ioctl command. This mechanism effectively allows an attacker with local access or control over nearby NFC hardware to leak sensitive kernel stack data, which can include pointers, cryptographic keys, or other confidential information residing in memory at the time of the vulnerability's exploitation.
From a classification perspective, this issue is categorized as CWE-457, Use of Uninitialized Variable, due to the reliance on uninitialized memory for critical logic and data copying operations. The attack vector aligns with ATT&CK technique T1083, File and Directory Discovery, or more accurately in this context, information leakage via improper resource handling, often associated with CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability stems from a failure to ensure data integrity before use, which is a common pitfall in low-level systems programming where stack memory reuse can lead to unpredictable behavior and security breaches if not explicitly managed by the developer.
The resolution involves ensuring that both on-stack notification structures are zero-initialized upon allocation. By using functions such as memset or designated initializers to clear the entire structure before parsing begins, any fields that do not receive explicit values from incoming packets will default to zero rather than retaining stale stack data. This prevents the subsequent memcpy operations in nci_add_new_protocol from copying garbage memory into user-accessible structures. System administrators and developers should apply kernel updates that include this fix immediately to mitigate the risk of information disclosure through NFC interfaces, particularly on devices where NFC hardware is enabled and accessible to local users or potentially remote attackers via compromised peripherals.