HIGH
nfc LlcpTlv OOB
CVE-2026-80799
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data advances offset past 255 it silently wraps to zero, causing infinite loops or double-processing of buffer data. 2. Before reading tlv[0] (type) and tlv[1] (length) there is no check that offset+2 <= tlv_array_len. A truncated TLV causes an OOB read of one byte past the buffer end. 3. After reading the length field, the value bytes are accessed without checking offset+2+length <= tlv_array_len. A crafted length=0xFF on a short buffer causes up to 255 bytes of OOB read past the buffer end. Both functions are reachable without authentication via nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes directly into nfc_llcp_parse_gb_tlv() with no additional validation. Fix all three issues by widening offset from u8 to u16 and adding bounds checks for both the TLV header and value field before each access.
02KernelScan AI Analysis
Risk summary
An attacker within NFC proximity can send crafted LLCP general bytes or connection TLVs to trigger out-of-bounds reads of up to 255 bytes past the buffer end and infinite loops via an integer wrapping bug. No authentication is required — only physical proximity to the target device's NFC interface. The OOB read can disclose kernel memory, and the loop or access to unmapped pages can cause a kernel hang or panic.
Vulnerability analysis
The NFC LLCP TLV parsers process structured data from a remote peer without checking whether each entry's header and payload still fit inside the received buffer. Because the parser also uses a counter that can wrap around, a malicious peer can make the loop run forever or re-process data. A crafted length value causes out-of-bounds reads far past the buffer end. The corrected code validates the remaining buffer space before every access and uses a counter large enough to handle the full buffer size. The flaw is triggered when the local NFC stack accepts connection setup data from an external device, so any attacker within NFC range can exploit it without authentication.
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.10.188 | 5.10.267 | 2c1456fe09ab |
| 4.19 | 4.19.291 | 4.20 | 7f6f3d087c67 |
| 5.4 | 5.4.251 | 5.5 | 9c47d6679635 |
| 5.15 | — | 5.15.218 | a209334ed929 |
| 6.1 | — | 6.1.185 | 382eaa770335 |
| 6.6 | — | 6.6.154 | 2d239590d184 |
| 6.12 | — | 6.12.106 | e84cdfdc4a6c |
| 6.18 | — | 6.18.47 | 875285a165fd |
| 7.1 | — | 7.1.11 | 78b20c8eeacd |
| 7.2 | — | 7.2.1 | — |
| mainline | — | 7.3-rc1 | — |