PT-2026-85644 · Linux · Linux
CVE-2026-80803
·
Published
2026-09-04
·
Updated
2026-09-04
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
nfc: digital: clamp SENSF RES length to the destination buffer
digital in recv sensf res() memcpy()s resp->len bytes from a remote
NFC-F device response into the NFC SENSF RES MAXSIZE-byte target.sensf res
field without an upper-bound check. A nearby malicious NFC-F device can
send an oversized SENSF RES response to overflow the stack-local struct
nfc target.
Clamp resp->len to NFC SENSF RES MAXSIZE before the copy.
Found by 0sec automated security-research tooling (https://0sec.ai).
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux