CVE-2026-80802

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The fdp nci i2c read() function fails to validate the packet length provided by the device. This value is used as the count for i2c master recv() into a 261-byte on-stack buffer. A malicious or malfunctioning controller can trigger a stack out-of-bounds write, potentially overwriting the canary and return address, or cause issues by providing a length below the minimum frame size. Additionally, the function allocates one data skb (socket buffer) per iteration; if a device sends two data packets in one call, the first skb is leaked when overwritten by the second allocation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.