CVE-2026-80800

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: bound the connect_sn TLV walk to the skb

Commit 27256cdb290e ("nfc: llcp: bound SNL TLV parsing to the skb and

add length checks") fixed the unbounded TLV walk in nfc_llcp_recv_snl(),

and commit d8bd2dedbde5 ("nfc: llcp: fix OOB read and u8 offset wrap in

TLV parsers") subsequently bounded nfc_llcp_parse_gb_tlv() and

nfc_llcp_parse_connection_tlv(). One sibling parser sharing the same

pattern remains unbounded: nfc_llcp_connect_sn().

nfc_llcp_connect_sn() walks a TLV list, reading a two-byte header

(type, length) followed by length bytes of value, without checking that

the two header bytes or the declared length stay within the buffer. It

returns a pointer to a service name of up to 255 bytes that may point

past the end of the skb; it is subsequently consumed by memcmp() in

nfc_llcp_sock_from_sn(). In addition tlv_array_len was computed as

"skb->len - LLCP_HEADER_SIZE" in size_t, so a CONNECT/CC frame sho

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References