CVE-2026-80823

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate ATR REQ length against the received frame

st21nfca tm recv atr req() checks that the received ATR REQ frame is at least ST21NFCA ATR REQ MIN SIZE and that the self-declared atr req->length is at least sizeof(struct st21nfca atr req), but never checks that atr req->length does not exceed the actual received length (skb->len).

st21nfca tm send atr res() then trusts the declared length:

gb len = atr req->length - sizeof(struct st21nfca atr req);
...
memcpy(atr res->gbi, atr req->gbi, gb len);

so an RF peer that sends a short frame but sets atr req->length larger than the frame makes gb len exceed the general bytes actually present, and the memcpy reads out of bounds past the received skb. Those bytes are placed in the ATR RES and sent back to the peer (kernel-memory disclosure to a proximity attacker); a larger declared length is an out-of-bounds read (DoS).

Reject frames whose declared length exceeds the received length. The adjacent nfc tm activated() path in the same function already derives its general-bytes length from skb->len rather than the declared field.

Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.