CVE-2026-80799

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The nfc llcp parse gb tlv() and nfc llcp parse connection tlv() functions contain three related bugs in their TLV (Type-Length-Value) parsing loops. First, the offset variable is declared as u8 while tlv array len is u16, which can cause the offset to wrap to zero when it exceeds 255, leading to infinite loops or double-processing of data. Second, the lack of a check to ensure offset+2 <= tlv array len before reading the type and length can result in an out-of-bounds (OOB) read of one byte. Third, accessing value bytes without verifying offset+2+length <= tlv array len allows a crafted length of 0xFF on a short buffer to cause an OOB read of up to 255 bytes. These functions are reachable without authentication via nfc llcp set remote gb(), which passes remote LLCP general bytes to nfc llcp parse gb tlv() without additional validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.