CVE-2026-80794

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix uninit-value in the RF discover/activated NTF handlers

nci rf discover ntf packet() and nci rf intf activated ntf packet() each parse a notification into an on-stack struct (nci rf discover ntf / nci rf intf activated ntf) that is not initialised. The RF technology-specific parameters are only extracted when rf tech specific params len is non-zero, so a notification that reports a zero length leaves the rf tech specific params union uninitialised - and both handlers then pass it to nci add new protocol(), which reads it:

nci add new protocol() uses nfca poll->nfcid1 len as both a branch condition and a memcpy() length and copies nfcid1/sens res/sel res into ndev->targets, which is later exposed to user space via NFC CMD GET TARGET.

BUG: KMSAN: uninit-value in nci add new protocol+0x624/0x6c0 nci add new protocol+0x624/0x6c0 nci ntf packet+0x25b2/0x3c30 nci rx work+0x318/0x5d0 process scheduled works+0x84b/0x17a0 worker thread+0xc10/0x11b0 kthread+0x376/0x500 Local variable ntf.i created at: nci ntf packet+0xbc2/0x3c30

Zero-initialise both on-stack notifications so the union reads back as zero when no technology-specific parameters are present.