{"id":"CVE-2026-80798","title":"nfc: llcp: reject PDUs shorter than the LLCP header","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: reject PDUs shorter than the LLCP header\n\nEvery LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the\nreceive path never checked that a frame i…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82","Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < f36cffea24bf3e2cc29a00d4b51dbcadc087d810","Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < a7b9b449f5a5132221fff6adc11a9431ab8cd914","Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < 3793d768b40f38bb97265dd5b9a8b8655c4e1b1d","Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < eab47618e282602197db287ecbd1b09d356a2515","Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < e969e98410051b1ef8cc318bfe0c7e3f24ec766d","Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < ae5f20f5842f440b72d030e3a34fe182dd8eae42","Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < d3d90243393c48146911c67fd3792b549d21d9e6","Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < 95674f506c6376d6722a23144c9acd26609771ed","Linux 3.3"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:43:51.441Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80798","references":[{"url":"https://git.kernel.org/stable/c/e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82"},{"url":"https://git.kernel.org/stable/c/f36cffea24bf3e2cc29a00d4b51dbcadc087d810"},{"url":"https://git.kernel.org/stable/c/a7b9b449f5a5132221fff6adc11a9431ab8cd914"},{"url":"https://git.kernel.org/stable/c/3793d768b40f38bb97265dd5b9a8b8655c4e1b1d"},{"url":"https://git.kernel.org/stable/c/eab47618e282602197db287ecbd1b09d356a2515"},{"url":"https://git.kernel.org/stable/c/e969e98410051b1ef8cc318bfe0c7e3f24ec766d"},{"url":"https://git.kernel.org/stable/c/ae5f20f5842f440b72d030e3a34fe182dd8eae42"},{"url":"https://git.kernel.org/stable/c/d3d90243393c48146911c67fd3792b549d21d9e6"},{"url":"https://git.kernel.org/stable/c/95674f506c6376d6722a23144c9acd26609771ed"}],"tags":["cve.org"],"epss":0.00234,"epssPercentile":0.13287,"ingestedAt":"2026-10-19T09:16:01.527Z","slug":"CVE-2026-80798","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: reject PDUs shorter than the LLCP header\n\nEvery LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the\nreceive path never checked that a frame is at least LLCP_HEADER_SIZE bytes\nbefore parsing it.\n\nnfc_llcp_rx_skb() reads the header via nfc_llcp_ptype()/nfc_llcp_dsap()/\nnfc_llcp_ssap(), which dereference pdu->data[0] and pdu->data[1], and a\nCONNECT or CC PDU then computes\n\n\ttlv_array_len = skb->len - LLCP_HEADER_SIZE;\n\nas a size_t and hands it to the TLV walk. When the frame is shorter than\nthe header the subtraction wraps to a huge value and the walk runs far\npast the buffer, an out-of-bounds read.\n\nA nearby NFC device can reach this without authentication; LLCP link\nactivation happens automatically after NFC-DEP.\n\nGuard the common receive choke point __nfc_llcp_recv(), shared by both the\ntarget (nfc_llcp_data_received()) and initiator (nfc_llcp_recv()) paths, so\na short skb is dropped before the rx_work worker parses it. Use\npskb_may_pull() rather than a skb->len test so the two header bytes are\nguaranteed to sit in the skb linear area even for a non-linear skb,\nmatching how the sibling NCI and HCI receive paths validate their headers.\n\nReproduced with a KFENCE out-of-bounds read via /dev/virtual_nci on\nlinux-next.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).\n\n## Affected\n\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82`\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < f36cffea24bf3e2cc29a00d4b51dbcadc087d810`\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < a7b9b449f5a5132221fff6adc11a9431ab8cd914`\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < 3793d768b40f38bb97265dd5b9a8b8655c4e1b1d`\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < eab47618e282602197db287ecbd1b09d356a2515`\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < e969e98410051b1ef8cc318bfe0c7e3f24ec766d`\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < ae5f20f5842f440b72d030e3a34fe182dd8eae42`\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < d3d90243393c48146911c67fd3792b549d21d9e6`\n- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < 95674f506c6376d6722a23144c9acd26609771ed`\n- `Linux 3.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}