CVE-2026-80823 nfc: st21nfca: validate ATR_REQ length against the received frame
A proximity attacker can trigger an out-of-bounds read in the Linux kernel NFC driver to disclose kernel memory or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80823?
CVE-2026-80823 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfc: st21nfca: validate ATR_REQ length against the received frame
st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at least ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req->length is at least sizeof(struct st21nfca_atr_req), but never checks that atr_req->length does not exceed the actual received length (skb->len).
st21nfca_tm_send_atr_res() then trusts the declared length:
gb_len = atr_req->length - sizeof(struct st21nfca_atr_req); ... memcpy(atr_res->gbi, atr_req->gbi, gb_len);
so an RF peer that sends a short frame but sets atr_req->length larger than the frame makes gb_len exceed the general bytes actually present, and the memcpy reads out of bounds past the received skb. Those bytes are placed in the ATR_RES and sent back to the peer (kernel-memory disclosure to a proximity attacker); a larger declared length is an out-of-bounds read (DoS).
Reject frames whose declared length exceeds the received length. The adjacent nfc_tm_activated() path in the same function already derives its general-bytes length from skb->len rather than the declared field.
Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.
Which versions are affected by CVE-2026-80823?
How do I fix CVE-2026-80823?
Apply the vendor's patch.
Is CVE-2026-80823 being exploited?
There is no known exploitation of CVE-2026-80823 in the wild and no public exploit code.
Sources
Also known as AZL-99561, BELL-CVE-2026-80823, DEBIAN-CVE-2026-80823, GHSA-vwx2-rh9p-3f2w, UBUNTU-CVE-2026-80823.