CVE-2026-80798

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: reject PDUs shorter than the LLCP header

Every LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the

receive path never checked that a frame is at least LLCP_HEADER_SIZE bytes

before parsing it.

nfc_llcp_rx_skb() reads the header via nfc_llcp_ptype()/nfc_llcp_dsap()/

nfc_llcp_ssap(), which dereference pdu->data[0] and pdu->data[1], and a

CONNECT or CC PDU then computes

tlv_array_len = skb->len - LLCP_HEADER_SIZE;

as a size_t and hands it to the TLV walk. When the frame is shorter than

the header the subtraction wraps to a huge value and the walk runs far

past the buffer, an out-of-bounds read.

A nearby NFC device can reach this without authentication; LLCP link

activation happens automatically after NFC-DEP.

Guard the common receive choke point __nfc_llcp_recv(), shared by both the

target (nfc_llcp_data_received()) and initiator (nfc_llcp_recv()) paths, so

a short skb is dropped before

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References