# CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

> An attacker can trigger out-of-bounds reads and infinite loops in the Linux kernel NFC LLCP TLV parser via crafted packets, leading to information disclosure or system crash.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 4 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-99657, BELL-CVE-2026-80799, DEBIAN-CVE-2026-80799, GHSA-2vfp-4qhq-6rfc, UBUNTU-CVE-2026-80799

## What is CVE-2026-80799?

CVE-2026-80799 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain
three related bugs in their TLV parsing loops:

1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data
   advances offset past 255 it silently wraps to zero, causing
   infinite loops or double-processing of buffer data.

2. Before reading tlv[0] (type) and tlv[1] (length) there is no
   check that offset+2 <= tlv_array_len. A truncated TLV causes
   an OOB read of one byte past the buffer end.

3. After reading the length field, the value bytes are accessed
   without checking offset+2+length <= tlv_array_len. A crafted
   length=0xFF on a short buffer causes up to 255 bytes of OOB
   read past the buffer end.

Both functions are reachable without authentication via
nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes
directly into nfc_llcp_parse_gb_tlv() with no additional
validation.

Fix all three issues by widening offset from u8 to u16 and adding
bounds checks for both the TLV header and value field before each
access.

## Which versions are affected by CVE-2026-80799?


## How do I fix CVE-2026-80799?

Apply the vendor's patch.

## Is CVE-2026-80799 being exploited?

There is no known exploitation of CVE-2026-80799 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-80799 and fix it if it is affected.

What it is: CVE-2026-80799 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-80799 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-80799/ (Markdown: https://insights.sbomify.com/CVE-2026-80799/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-80799
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80799
- OSV: https://osv.dev/vulnerability/CVE-2026-80799

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-80799/
Summaries are generated and may contain mistakes; the official description above is the record.