CVE-2026-80795 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
nci_target_auto_activated() appends a target to the fixed-size array ndev->targets[NCI_MAX_DISCOVERED_TARGETS] and increments ndev->n_targets
without first checking the array is full; unlike its sibling nci_add_new_target(), which bails out when n_targets already equals NCI_MAX_DISCOVERED_TARGETS.
ndev->n_targets is only cleared by nci_clear_target_list(), so an NFCC that repeatedly re-runs discovery (RF_DISCOVER_RSP, which re-enters NCI_DISCOVERY without clearing the target list) and reports an auto-activated target (RF_INTF_ACTIVATED_NTF) drives n_targets past the limit. The append then writes a struct nfc_target past the end of the array (a slab out-of-bounds write), and nfc_targets_found() goes on to walk the array with the inflated count:
BUG: KASAN: slab-out-of-bounds in nci_add_new_protocol+0x94/0x2ac [nci]
Write of size 2 at addr ffff0000c7299a18 by task kworker/u8:0/12 Workqueue: nfc0_nci_rx_wq nci_rx_work [nci]
Call trace: nci_add_new_protocol+0x94/0x2ac [nci]
nci_ntf_packet+0xddc/0x11a0 [nci]
nci_rx_work+0x15c/0x1e0 [nci]
process_one_work+0x2dc/0x500 worker_thread+0x240/0x460 kthread+0x1c0/0x1d0 ret_from_fork+0x10/0x20
The buggy address belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1024 bytes to the right of allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618)
Guard nci_target_auto_activated() with the same check used by nci_add_new_target().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's Near Field Communication subsystem contains a critical memory safety vulnerability within the NCI driver, specifically in the function responsible for handling auto-activated targets. This flaw manifests as an out-of-bounds write that can lead to kernel instability or potential privilege escalation depending on the attacker's ability to control the input data. The issue arises from a discrepancy in boundary checking logic between two related functions: nci_add_new_target and nci_target_auto_activated. While the former correctly validates whether the target array has reached its maximum capacity before appending new entries, the latter fails to perform this essential check. This inconsistency allows an attacker who can influence NFC discovery processes to exceed the allocated memory limits for storing discovered targets.
The technical root cause lies in how the driver manages the ndev->targets array and the associated counter ndev->n_targets. The array is fixed-size with a maximum limit defined by NCI_MAX_DISCOVERED_TARGETS. Under normal operation, nci_add_new_target ensures that no more than this number of targets are stored. However, when an NFC controller chip repeatedly re-runs discovery procedures via RF_DISCOVER_RSP messages without clearing the existing target list, and subsequently reports auto-activated targets through RF_INTF_ACTIVATED_NTF notifications, the system enters a state where nci_target_auto_activated is invoked multiple times. Because this function does not verify if ndev->n_targets has reached NCI_MAX_DISCOVERED_TARGETS before appending to the array, it continues to write struct nfc_target elements beyond the allocated memory region. This results in a slab out-of-bounds write, corrupting adjacent kernel data structures and potentially overwriting critical control flow information or other sensitive pointers within the kmalloc-2k cache.
The operational impact of this vulnerability is severe due to its potential for exploitation by physically proximate attackers. An adversary with access to NFC-enabled devices can craft malicious RF signals that trigger repeated discovery cycles and auto-activation events, effectively flooding the kernel's target list buffer. The immediate consequence observed in testing includes a Kernel Address Sanitizer (KASAN) bug report indicating an invalid write operation at a specific memory address offset from the allocated region. This corruption can lead to system crashes, denial of service conditions where the NFC subsystem becomes unresponsive or causes broader kernel panics, and potentially arbitrary code execution if the overwritten memory contains function pointers or security-critical structures that are later dereferenced by other parts of the kernel such as nci_add_new_protocol during subsequent protocol handling.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, which describes writing data to a buffer beyond its allocated boundaries. In terms of attack vectors and techniques, it relates to ATT&CK technique T1059: Command and Scripting Interpreter if the corruption leads to code execution, or more broadly to physical layer attacks leveraging NFC protocols as described in MITRE Engenuity's coverage for wireless communication vulnerabilities. The lack of input validation on external RF signals represents a failure to enforce proper boundary checks against untrusted data sources originating from hardware interfaces.
To mitigate this vulnerability, developers must apply the same boundary check logic present in nci_add_new_target to the nci_target_auto_activated function. This involves verifying that ndev->n_targets is less than NCI_MAX_DISCOVERED_TARGETS before attempting to append a new target structure to the array. If the limit has been reached, the function should bail out gracefully rather than proceeding with the write operation. Additionally, system administrators and developers should ensure that kernel updates incorporating this fix are applied promptly. For environments where NFC hardware is not strictly required for operations, disabling the relevant kernel modules or physical ports can reduce the attack surface by preventing exposure to RF-based exploitation attempts until patches are deployed.