In the Linux kernel, the following vulnerability has been resolved:

nfc: nfcmrvl: validate helper command length before pull

The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach the data access before the malformed packet is rejected.

Validate the complete helper command length before stripping the NCI data header.