CVE-2026-80794

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NFC NCI handlers where nci rf discover ntf packet() and nci rf intf activated ntf packet() parse notifications into uninitialized on-stack structures (nci rf discover ntf and nci rf intf activated ntf). When the rf tech specific params len variable is zero, the rf tech specific params union remains uninitialized. These handlers then pass the union to the nci add new protocol() function, which uses nfca poll->nfcid1 len as a branch condition and a memcpy() length. This process copies uninitialized data from nfcid1, sens res, or sel res into ndev->targets, which is subsequently exposed to user space via the NFC CMD GET TARGET endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.