CVE-2026-80795

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix out-of-bounds write in nci target auto activated()

nci target auto activated() appends a target to the fixed-size array ndev->targets[NCI MAX DISCOVERED TARGETS] and increments ndev->n targets without first checking the array is full; unlike its sibling nci add new target(), which bails out when n targets already equals NCI MAX DISCOVERED TARGETS.

ndev->n targets is only cleared by nci clear target list(), so an NFCC that repeatedly re-runs discovery (RF DISCOVER RSP, which re-enters NCI DISCOVERY without clearing the target list) and reports an auto-activated target (RF INTF ACTIVATED NTF) drives n targets past the limit. The append then writes a struct nfc target past the end of the array (a slab out-of-bounds write), and nfc targets found() goes on to walk the array with the inflated count:

BUG: KASAN: slab-out-of-bounds in nci add new protocol+0x94/0x2ac [nci] Write of size 2 at addr ffff0000c7299a18 by task kworker/u8:0/12 Workqueue: nfc0 nci rx wq nci rx work [nci] Call trace: nci add new protocol+0x94/0x2ac [nci] nci ntf packet+0xddc/0x11a0 [nci] nci rx work+0x15c/0x1e0 [nci] process one work+0x2dc/0x500 worker thread+0x240/0x460 kthread+0x1c0/0x1d0 ret from fork+0x10/0x20

The buggy address belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1024 bytes to the right of allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618)

Guard nci target auto activated() with the same check used by nci add new target().