CVE-2026-80798

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the Logical Link Control Protocol (LLCP) implementation of the NFC subsystem. The receive path fails to verify that a frame is at least LLCP HEADER SIZE bytes before parsing. When the nfc llcp rx skb() function processes a frame shorter than the header, the calculation of tlv array len using skb->len - LLCP HEADER SIZE results in an integer wrap-around to a very large value. This causes the subsequent TLV walk to read far beyond the buffer boundaries. An unauthenticated nearby NFC device can trigger this issue during LLCP link activation. The flaw involves the nfc llcp recv() function, which is shared by the nfc llcp data received() and nfc llcp recv() paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.