CVE-2026-80801 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: microread: validate target discovery payload lengths
microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate. The fixed field offsets and UID copies were checked only against the destination nfc_target buffers, not against the actual skb length.
Validate that each gate-specific payload contains the fixed fields and UID bytes before reading or copying them.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's Near Field Communication subsystem contained a critical input validation flaw within the microread NFC driver, specifically in the function responsible for handling target discovery events. This vulnerability arises from an insufficient boundary check when parsing incoming data packets received via the HCI gate interface. The core issue lies in how the driver processes payload lengths associated with discovered targets. When a new NFC target is detected and reported to the kernel, the microread_target_discovered() routine attempts to extract specific fields such as fixed configuration parameters and unique identifiers from the socket buffer's data segment. However, prior to this resolution, the code only verified that these extracted values would fit into the destination nfc_target structures in memory. It failed to verify whether the source packet itself contained enough bytes to safely perform these read operations.
This discrepancy creates a classic out-of-bounds read condition where the driver may attempt to access memory locations beyond the allocated size of the incoming network buffer. In practical terms, if an attacker can influence or control the content of NFC communication packets directed at devices utilizing this specific microread hardware interface, they could craft malformed payloads with truncated lengths. When the kernel processes these maliciously crafted packets, it will proceed to copy data based on expected field sizes rather than actual available packet length. This leads to reading arbitrary memory contents that reside immediately after the buffer's end boundary. Such behavior constitutes a CWE-125 vulnerability class, specifically out-of-bounds read, which is frequently exploited in conjunction with other flaws to achieve unauthorized information disclosure or system instability.
The operational impact of this flaw extends beyond simple data leakage. While primarily an information disclosure risk where sensitive kernel memory contents could be exposed depending on what resides adjacent to the socket buffer, it also poses a significant stability threat. Depending on how subsequent code handles the corrupted or garbage data retrieved from these out-of-bounds reads, there is potential for logic errors that could trigger kernel panics or denial of service conditions. Furthermore, in complex exploitation scenarios involving heap spraying or specific memory layouts, such information leaks can aid attackers in bypassing security mitigations like ASLR by revealing exact memory addresses. The vulnerability falls under the ATT&CK technique T1082, which covers system information discovery, as it allows an entity to gather internal state details from the operating system through malformed NFC interactions.
To mitigate this risk, developers must ensure that all input data originating from external interfaces is strictly validated against its declared length before any parsing or copying operations occur. The fix implemented involves adding explicit checks within microread_target_discovered() to confirm that each gate-specific payload contains sufficient bytes for both the fixed fields and the UID copies prior to accessing them. This defensive programming practice ensures that the driver respects packet boundaries and prevents access to unauthorized memory regions. System administrators should apply kernel updates that include this patch immediately, particularly on devices relying on microread NFC hardware solutions. Regular auditing of network interface drivers for similar boundary validation gaps is recommended as a broader security hygiene measure to prevent analogous vulnerabilities in other subsystems handling untrusted input data streams.