---
id: CVE-2026-80798
title: 'nfc: llcp: reject PDUs shorter than the LLCP header'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfc: llcp: reject PDUs shorter than the LLCP header

  Every LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the
  receive path never checked that a frame i…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    f36cffea24bf3e2cc29a00d4b51dbcadc087d810
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    a7b9b449f5a5132221fff6adc11a9431ab8cd914
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    3793d768b40f38bb97265dd5b9a8b8655c4e1b1d
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    eab47618e282602197db287ecbd1b09d356a2515
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    e969e98410051b1ef8cc318bfe0c7e3f24ec766d
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    ae5f20f5842f440b72d030e3a34fe182dd8eae42
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    d3d90243393c48146911c67fd3792b549d21d9e6
  - >-
    Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a <
    95674f506c6376d6722a23144c9acd26609771ed
  - Linux 3.3
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:43:51.441Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80798'
references:
  - url: 'https://git.kernel.org/stable/c/e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82'
  - url: 'https://git.kernel.org/stable/c/f36cffea24bf3e2cc29a00d4b51dbcadc087d810'
  - url: 'https://git.kernel.org/stable/c/a7b9b449f5a5132221fff6adc11a9431ab8cd914'
  - url: 'https://git.kernel.org/stable/c/3793d768b40f38bb97265dd5b9a8b8655c4e1b1d'
  - url: 'https://git.kernel.org/stable/c/eab47618e282602197db287ecbd1b09d356a2515'
  - url: 'https://git.kernel.org/stable/c/e969e98410051b1ef8cc318bfe0c7e3f24ec766d'
  - url: 'https://git.kernel.org/stable/c/ae5f20f5842f440b72d030e3a34fe182dd8eae42'
  - url: 'https://git.kernel.org/stable/c/d3d90243393c48146911c67fd3792b549d21d9e6'
  - url: 'https://git.kernel.org/stable/c/95674f506c6376d6722a23144c9acd26609771ed'
tags:
  - cve.org
epss: 0.00234
epssPercentile: 0.13287
ingestedAt: '2026-10-19T09:16:01.527Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: reject PDUs shorter than the LLCP header

Every LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the
receive path never checked that a frame is at least LLCP_HEADER_SIZE bytes
before parsing it.

nfc_llcp_rx_skb() reads the header via nfc_llcp_ptype()/nfc_llcp_dsap()/
nfc_llcp_ssap(), which dereference pdu->data[0] and pdu->data[1], and a
CONNECT or CC PDU then computes

	tlv_array_len = skb->len - LLCP_HEADER_SIZE;

as a size_t and hands it to the TLV walk. When the frame is shorter than
the header the subtraction wraps to a huge value and the walk runs far
past the buffer, an out-of-bounds read.

A nearby NFC device can reach this without authentication; LLCP link
activation happens automatically after NFC-DEP.

Guard the common receive choke point __nfc_llcp_recv(), shared by both the
target (nfc_llcp_data_received()) and initiator (nfc_llcp_recv()) paths, so
a short skb is dropped before the rx_work worker parses it. Use
pskb_may_pull() rather than a skb->len test so the two header bytes are
guaranteed to sit in the skb linear area even for a non-linear skb,
matching how the sibling NCI and HCI receive paths validate their headers.

Reproduced with a KFENCE out-of-bounds read via /dev/virtual_nci on
linux-next.

Found by 0sec automated security-research tooling (https://0sec.ai).

## Affected

- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82`
- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < f36cffea24bf3e2cc29a00d4b51dbcadc087d810`
- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < a7b9b449f5a5132221fff6adc11a9431ab8cd914`
- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < 3793d768b40f38bb97265dd5b9a8b8655c4e1b1d`
- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < eab47618e282602197db287ecbd1b09d356a2515`
- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < e969e98410051b1ef8cc318bfe0c7e3f24ec766d`
- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < ae5f20f5842f440b72d030e3a34fe182dd8eae42`
- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < d3d90243393c48146911c67fd3792b549d21d9e6`
- `Linux >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a < 95674f506c6376d6722a23144c9acd26609771ed`
- `Linux 3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.