CVE-2026-80795

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix out-of-bounds write in nci_target_auto_activated()

nci_target_auto_activated() appends a target to the fixed-size array

ndev->targets[NCI_MAX_DISCOVERED_TARGETS] and increments ndev->n_targets

without first checking the array is full; unlike its sibling

nci_add_new_target(), which bails out when n_targets already equals

NCI_MAX_DISCOVERED_TARGETS.

ndev->n_targets is only cleared by nci_clear_target_list(), so an NFCC

that repeatedly re-runs discovery (RF_DISCOVER_RSP, which re-enters

NCI_DISCOVERY without clearing the target list) and reports an

auto-activated target (RF_INTF_ACTIVATED_NTF) drives n_targets past the

limit. The append then writes a struct nfc_target past the end of the

array (a slab out-of-bounds write), and nfc_targets_found() goes on to

walk the array with the inflated count:

BUG: KASAN: slab-out-of-bounds in nci_add_new_protocol+0x94/0x2ac [nci]

Write of size 2 at addr ffff0000c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References