CVE-2026-80803 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: digital: clamp SENSF_RES length to the destination buffer
digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target.
Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy.
Found by 0sec automated security-research tooling (https://0sec.ai).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's Near Field Communication subsystem contains a critical buffer overflow vulnerability within the digital protocol handling logic, specifically in the function responsible for receiving SENSF_RES responses from NFC-F devices. This flaw arises because the implementation performs a direct memory copy operation without validating that the length of the incoming response data fits within the allocated destination buffer. The target structure, nfc_target, contains a fixed-size field named sensf_res with a maximum capacity defined by NFC_SENSF_RES_MAXSIZE. When processing responses from remote devices, the kernel blindly trusts the length value provided in the protocol header and copies resp->len bytes into this stack-allocated buffer. This lack of bounds checking creates a classic heap or stack-based buffer overflow condition depending on the exact memory layout, allowing an attacker to write data beyond the boundaries of the intended variable.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via physical proximity. An adversary with access to NFC-F capable hardware can craft and transmit maliciously oversized SENSF_RES packets to a vulnerable device running the affected Linux kernel version. By sending a response where resp->len exceeds NFC_SENSF_RES_MAXSIZE, the attacker forces the memcpy operation to overwrite adjacent memory locations on the stack or heap. This out-of-bounds write can corrupt critical data structures, alter control flow pointers, or leak sensitive information from memory. In many scenarios, such buffer overflows in kernel space provide a direct path to arbitrary code execution with root privileges, effectively compromising the entire system's integrity and confidentiality. The vulnerability is particularly dangerous because NFC interfaces are often exposed on mobile devices, IoT gadgets, and embedded systems where physical access might be easier for attackers than network-based intrusion vectors.
From a classification perspective, this issue aligns closely with CWE-120, which describes buffer copy without checking size limits, as the core failure lies in the absence of input validation before memory manipulation. It also relates to CWE-787, an out-of-bounds write vulnerability, since data is written past the end of a defined buffer region. In terms of attack tactics, this flaw supports techniques associated with ATT&CK ID T1059, specifically command and script interpretation or execution through kernel exploitation, as well as potential privilege escalation paths if combined with other local vulnerabilities. The root cause stems from insufficient trust boundaries between user-space initiated requests and internal kernel data structures, highlighting the need for rigorous input sanitization in low-level protocol handlers that interact directly with external hardware inputs.
To mitigate this vulnerability, system administrators must apply the provided kernel patch which explicitly clamps resp->len to NFC_SENSF_RES_MAXSIZE prior to executing the memory copy operation. This ensures that any incoming response data is truncated if it exceeds the buffer's capacity, thereby preventing overflow conditions. Organizations relying on Linux-based embedded systems or mobile devices with NFC capabilities should prioritize updating their kernels to versions where this fix has been integrated. Additionally, developers implementing similar protocol handlers in other subsystems should adopt defensive programming practices by always validating input lengths against destination buffer sizes before performing copy operations. Regular security audits and static analysis using tools like those from 0sec can help identify such oversights early in the development lifecycle, reducing the attack surface for physical-layer exploits targeting kernel memory safety.