CVE-2026-80796 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: add data_len bound checks to activation parameter extractors
nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() read an inner length byte from the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed kernel buffers, but neither function receives the caller-validated activation_params_len. A crafted NCI notification with activation_params_len=1 and an inner length byte of up to 20 (NFC-A) or 50 (NFC-B) causes memcpy() to read that many bytes past the one valid byte in the activation params region -- a slab out-of-bounds read of kernel memory adjacent to the NCI skb.
The sibling nci_extract_rf_params_*() family was given equivalent protection by commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter validation for packet data"), but the two activation parameter extractors were not updated at that time.
Add a data_len parameter to both functions, guard against an empty region before consuming the inner length byte, decrement the remaining count after consuming it, and clamp the copy length to what is actually available. Update both call sites to pass ntf.activation_params_len, which is already validated against the skb at ntf.c:801.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's Near Field Communication subsystem contains a critical input validation flaw within the NCI protocol implementation that allows for out-of-bounds memory reads. Specifically, the functions responsible for extracting activation parameters from NFC-A and NFC-B devices, namely nci_extract_activation_params_iso_dep and nci_extract_activation_params_nfc_dep, fail to properly validate the length of data being processed against the actual buffer boundaries. These routines read an inner length byte from the NCI RF_INTF_ACTIVATED_NTF payload and subsequently use that value as a counter for memcpy operations into fixed-size kernel buffers. The core issue lies in the fact that these functions do not receive or utilize the caller-validated activation_params_len variable, which represents the total size of the activation parameters region within the socket buffer. This oversight creates a scenario where maliciously crafted NCI notifications can exploit this lack of boundary checking to trigger unauthorized memory access operations.
When an attacker provides a crafted NCI notification with an activation_params_len value set to one byte but includes an inner length byte indicating a significantly larger data size, such as up to twenty bytes for NFC-A or fifty bytes for NFC-B, the kernel proceeds to execute memcpy operations that exceed the allocated buffer limits. This results in a slab out-of-bounds read of kernel memory adjacent to the NCI socket buffer. The vulnerability stems from an inconsistency where sibling functions within the nci_extract_rf_params family were previously hardened against similar issues by commit 571dcbeb8e63, which fixed parameter validation for packet data, yet these specific activation parameter extractors remained unpatched and vulnerable. This discrepancy highlights a gap in the systematic application of security controls across related code paths within the NFC subsystem.
The operational impact of this vulnerability is primarily centered on information disclosure through kernel memory leakage. By reading adjacent memory regions that are not part of the intended data structure, an attacker can potentially extract sensitive kernel data into user-space or other accessible locations. While the immediate vector involves a read operation rather than arbitrary code execution, such out-of-bounds reads often serve as precursors to more severe exploits by allowing attackers to gather information about kernel layout, stack contents, or other security-critical structures that could facilitate further attacks like return-oriented programming or heap spraying techniques. The vulnerability affects systems utilizing NFC hardware and processing NCI protocol messages, particularly those handling activation notifications from potentially untrusted or compromised NFC tags and readers.
To mitigate this risk, the Linux kernel maintainers have implemented a fix that introduces explicit data length parameters to both affected extraction functions. This enhancement ensures that before consuming any inner length bytes, the code verifies that there is sufficient remaining space in the buffer. The logic now decrements the available count after processing initial fields and clamps the copy length strictly to what is actually available within the validated bounds. Furthermore, all call sites have been updated to pass the ntf.activation_params_len variable, which has already undergone validation against the socket buffer size at an earlier stage in the packet processing pipeline. This change aligns these functions with established security practices and closes the gap left by previous partial hardening efforts.
From a classification perspective, this vulnerability corresponds to CWE-125, Out-of-bounds Read, as it involves accessing memory beyond the intended boundary of a buffer due to insufficient validation of input data lengths. In terms of offensive cybersecurity frameworks, this flaw aligns with ATT&CK technique T1083, File and Directory Discovery, or more broadly T1005, Data from Local System, depending on how the leaked information is utilized by an attacker seeking to enumerate system state for subsequent exploitation phases. The fix demonstrates the importance of consistent input validation across all code paths that handle external network data, ensuring that length fields are always cross-referenced with actual buffer capacities before any memory copy operations occur.