CVE-2026-63915

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds heap read occurs during HCP header parsing. The functions nfc hci recv from llc() and nci hci data received cb() access packet->header from skb->data without verifying that the buffer contains at least one byte. A malicious NFC peer can trigger this by sending a 0-byte HCP frame. Additionally, if such a frame is queued as a non-final fragment, it can cause the msg len variable to underflow to UINT MAX, leading to a system panic via skb over panic() during the writing of the reassembled skb.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.