In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: drop truncated I/RR/RNR PDUs in nfc llcp recv hdlc()

nfc llcp recv hdlc() reads the sequence byte skb->data[2], via nfc llcp ns()/nfc llcp nr(), before any length check. The receive path only guarantees the two-byte LLCP header -- nfc llcp recv() checks it with pskb may pull() and nfc llcp recv agf() admits two-byte inner PDUs -- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb tailroom. The byte becomes N(R)/N(S); a peer can already set those with a well-formed PDU, so this is acting on uninitialised memory, not new peer control.

Guard the read with pskb may pull(), as commit 95674f506c63 ("nfc: llcp: reject PDUs shorter than the LLCP header") did for the two-byte header, so the sequence byte is present and linear before it is read. RR and RNR PDUs are LLCP HEADER SIZE + LLCP SEQUENCE SIZE bytes and an I PDU is longer, so no valid frame is rejected; a truncated PDU is malformed, so return without a DM reply.