HIGH Introduced in 3.13
nfc SensfRes Overflow
CVE-2026-80803
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target. Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy. Found by 0sec automated security-research tooling (https://0sec.ai).
02KernelScan AI Analysis
Risk summary
A nearby malicious NFC-F device can send an oversized SENSF_RES polling response that overflows a fixed-size stack buffer in the kernel's NFC digital layer. This stack overflow can corrupt adjacent stack data, potentially leading to arbitrary code execution in kernel context or a kernel panic. No user interaction or local privileges are required—only physical proximity to a device with NFC-F polling active.
Vulnerability analysis
When the NFC digital stack receives a SENSF_RES response during NFC-F polling, it copies the entire response payload into a fixed-size stack-local structure without first checking that the response length fits the destination buffer. A nearby malicious NFC-F device can exploit this by sending an oversized response, causing a stack buffer overflow that corrupts adjacent kernel stack data. The fix clamps the response length to the maximum allowed buffer size before performing the copy, ensuring only the portion that fits is accepted. The vulnerable code path is reached automatically during NFC-F target polling—no user interaction or privileges on the host are required—so any device with NFC hardware active and NFC-F polling enabled is exposed to an attacker within NFC communication range (a few centimeters).
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.13 | 5.10.267 | 6afb29751ee7 |
| 5.15 | 3.13 | 5.15.218 | e886c63d2ca7 |
| 6.1 | 3.13 | 6.1.185 | 4e942da2869b |
| 6.12 | 3.13 | 6.12.106 | af4c0606f743 |
| 6.18 | 3.13 | 6.18.47 | a56773e649ea |
| 6.6 | 3.13 | 6.6.154 | d0756a98277e |
| 7.1 | 3.13 | 7.1.11 | a1ef9bddfbb3 |
| 7.2 | 3.13 | 7.2.1 | 31aa28ed732f |
| mainline | 3.13 | 7.3-rc1 | 344a56d7c8e0 |