CVE-2026-31622: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
In the Linux kernel, the following vulnerability has been resolved:
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
The NFC-A anti-collision cascade in digitalinrecvsddres() appends 3 or 4 bytes to target->nfcid1 on each round, but the number of cascade rounds is controlled entirely by the peer device. The peer sets the cascade tag in the SDDRES (deciding 3 vs 4 bytes) and the cascade-incomplete bit in the SELRES (deciding whether another round follows).
ISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is sized accordingly (NFCNFCID1MAXSIZE = 10), but nothing in the driver actually enforces this. This means a malicious peer can keep the cascade running, writing past the heap-allocated nfctarget with each round.
Fix this by rejecting the response when the accumulated UID would exceed the buffer.
Commit e329e71013c9 ("NFC: nci: Bounds check struct nfctarget arrays") fixed similar missing checks against the same field on the NCI path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the NFC-A SDD response handler, reject the response when the accumulated UID would exceed the target->nfcid1 buffer, enforcing the NFC_NFCID1_MAXSIZE = 10 limit and preventing cascade processing beyond three cascade levels.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31622?
CVE-2026-31622 has a severity rating that indicates potential risks associated with the bounds check failure in the NFC-A cascade depth.
How do I fix CVE-2026-31622?
To fix CVE-2026-31622, update the Linux kernel to the latest version where the vulnerability has been addressed.
Which versions of the Linux kernel are affected by CVE-2026-31622?
CVE-2026-31622 affects certain versions of the Linux kernel that do not include the necessary bounds checks in the NFC-A cascade.
What impact does CVE-2026-31622 have on system security?
CVE-2026-31622 can lead to vulnerabilities that may allow an attacker to exploit the NFC-A cascade response, potentially leading to information exposure.
Is CVE-2026-31622 related to user data security?
Yes, CVE-2026-31622 can pose risks to user data security due to improper handling of NFC-A communications.