CVE-2026-80801None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate. The …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
nfc: microread: validate target discovery payload lengths
microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate. The fixed field offsets and UID copies were checked only against the destination nfc_target buffers, not against the actual skb length.
Validate that each gate-specific payload contains the fixed fields and UID bytes before reading or copying them.
Linux >= cfad1ba87150e198be9ea32367a24e500e59de2c < c6de4241f2efbbab286efbb84a9c7190298b3052Linux >= cfad1ba87150e198be9ea32367a24e500e59de2c < 92a6f0201bb68391b5eba1b3f330af007d7323b6Linux >= cfad1ba87150e198be9ea32367a24e500e59de2c < cb298672282421159e53ab311fe49d204c8a52daLinux >= cfad1ba87150e198be9ea32367a24e500e59de2c < 18f02354ed229b8e4561b580812d026e7eb29c85Linux >= cfad1ba87150e198be9ea32367a24e500e59de2c < e6397fe7b8b5ef18e051f49612d40ff476c5f7d9Linux >= cfad1ba87150e198be9ea32367a24e500e59de2c < d0902a7c454326c6384c614226ab8987f3fd425dLinux >= cfad1ba87150e198be9ea32367a24e500e59de2c < dabfa26a208e56f4d8dbf26fddc48f188bdb0649Linux >= cfad1ba87150e198be9ea32367a24e500e59de2c < 953963b9ac5eecbb316617d337bfaa3d731e3c5eLinux >= cfad1ba87150e198be9ea32367a24e500e59de2c < 25519469972ef57c3edb1805dabd6c5612b90211Linux 3.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98769Noneusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98774Nonerust_binder: cancel deferred work items in thread exit
CVE-2026-98772NoneUSB: serial: fix port tear down use-after-free
CVE-2026-98771Noneusb: storage: sierra_ms: reject short SWoC info transfers
CVE-2026-98776Nonebinderfs: fix UAF write in binder_add_device