CVE-2026-80799 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related bugs in their TLV parsing loops:
1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data advances offset past 255 it silently wraps to zero, causing infinite loops or double-processing of buffer data.
2. Before reading tlv[0] (type) and tlv[1] (length) there is no
check that offset+2 <= tlv_array_len. A truncated TLV causes an OOB read of one byte past the buffer end.
3. After reading the length field, the value bytes are accessed without checking offset+2+length <= tlv_array_len. A crafted length=0xFF on a short buffer causes up to 255 bytes of OOB read past the buffer end.
Both functions are reachable without authentication via nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes directly into nfc_llcp_parse_gb_tlv() with no additional validation.
Fix all three issues by widening offset from u8 to u16 and adding bounds checks for both the TLV header and value field before each access.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's Near Field Communication subsystem contains a critical vulnerability within its Link Connectionless Protocol implementation, specifically affecting the parsing of Type-Length-Value structures in general bytes and connection parameters. This flaw resides primarily in two functions, nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv(), which are responsible for processing incoming data from remote NFC devices. The vulnerability arises due to insufficient validation checks during the iteration over TLV arrays, leading to both out-of-bounds memory reads and potential infinite loops that can degrade system stability or lead to denial of service conditions.
The first technical flaw involves a type mismatch in loop control variables where the offset variable is declared as an unsigned 8-bit integer while the total length of the TLV array is stored as an unsigned 16-bit integer. When processing large amounts of data, the offset value can exceed two hundred fifty-five and silently wrap around to zero due to overflow behavior inherent to fixed-width integers. This wrapping causes the parsing loop to restart from the beginning of the buffer or process previously handled sections repeatedly, resulting in infinite loops that consume CPU resources indefinitely without progressing through the remaining valid data structures effectively.
The second issue pertains to a lack of boundary verification before accessing the initial fields of each TLV entry. Specifically, there is no check ensuring that adding two bytes for the type and length fields does not exceed the total array length. If an attacker provides a truncated TLV structure where only one byte remains or fewer than required header elements are present, the parser will read past the end of the allocated buffer to retrieve these values. This constitutes an out-of-bounds read that can expose sensitive kernel memory contents to remote attackers who control the input stream from connected NFC devices.
A third related vulnerability exists in the handling of variable-length data fields within TLVs. After reading the length byte, which indicates how many bytes follow for the value portion, the code accesses these subsequent bytes without verifying that the sum of the current offset plus two header bytes and the specified length does not exceed the buffer limit. An attacker can craft a malicious packet with a maximum length field value while providing insufficient actual data in the payload. This forces the parser to read up to two hundred fifty-five bytes beyond the end of the valid memory region, leading to further out-of-bounds reads that may leak kernel information or cause unpredictable system behavior depending on what lies adjacent in physical memory.
These vulnerabilities are particularly severe because they are reachable without any form of authentication via the nfc_llcp_set_remote_gb() function. This interface allows remote NFC devices to feed general bytes directly into the parsing logic with no additional validation layers acting as a gatekeeper. Consequently, an attacker within radio range can exploit these flaws by simply establishing a connection and transmitting specially crafted LLCP messages designed to trigger the buffer over-reads or infinite loops described above.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow resulting in Wraparound which leads to the loop control failure, as well as CWE-125 Out-of-bounds Read affecting memory safety and confidentiality. In terms of attack vectors, it falls under ATT&CK technique T1498 Network Denial of Service if exploited for resource exhaustion via infinite loops, or potentially information disclosure techniques if the out-of-bounds reads successfully leak kernel data to user space through subsequent exploitation chains involving other vulnerabilities that allow reading arbitrary memory locations.
The resolution involves widening the offset variable from an unsigned 8-bit integer to an unsigned 16-bit integer to prevent wraparound issues during iteration over larger buffers. Additionally, strict bounds checking has been implemented before every access point within the parsing loops. These checks ensure that there is sufficient data remaining in the buffer for both the two-byte TLV header and any subsequent value bytes indicated by the length field. By validating these constraints prior to memory access, the kernel prevents out-of-bounds reads and ensures that processing terminates correctly when malformed or truncated input is encountered, thereby restoring integrity and stability to the NFC subsystem.