CVE-2026-80795: nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix out-of-bounds write in ncitargetautoactivated()
ncitargetautoactivated() appends a target to the fixed-size array ndev->targets[NCIMAXDISCOVEREDTARGETS] and increments ndev->ntargets without first checking the array is full; unlike its sibling nciaddnewtarget(), which bails out when ntargets already equals NCIMAXDISCOVEREDTARGETS.
ndev->ntargets is only cleared by ncicleartargetlist(), so an NFCC that repeatedly re-runs discovery (RFDISCOVERRSP, which re-enters NCIDISCOVERY without clearing the target list) and reports an auto-activated target (RFINTFACTIVATEDNTF) drives ntargets past the limit. The append then writes a struct nfctarget past the end of the array (a slab out-of-bounds write), and nfctargetsfound() goes on to walk the array with the inflated count:
BUG: KASAN: slab-out-of-bounds in nciaddnewprotocol+0x94/0x2ac [nci] Write of size 2 at addr ffff0000c7299a18 by task kworker/u8:0/12 Workqueue: nfc0ncirxwq ncirxwork [nci] Call trace: nciaddnewprotocol+0x94/0x2ac [nci] ncintfpacket+0xddc/0x11a0 [nci] ncirxwork+0x15c/0x1e0 [nci] processonework+0x2dc/0x500 workerthread+0x240/0x460 kthread+0x1c0/0x1d0 retfromfork+0x10/0x20
The buggy address belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1024 bytes to the right of allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618)
Guard ncitargetautoactivated() with the same check used by nciaddnewtarget().
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An NFC controller must repeatedly re-run discovery without the target list being cleared and report an auto-activated target. This causes the NCI driver's target count to exceed its fixed target-array limit.
What is the practical impact once the condition is triggered?
The driver writes a struct nfc_target past the end of a slab-allocated array and subsequently walks the array using the inflated count. The reported failure is a KASAN slab out-of-bounds write in the NCI receive workqueue.
How can I determine whether a system is exposed to the triggering path?
Systems using the Linux kernel NCI NFC driver are exposed to this path when their NFC controller can repeatedly issue discovery responses and auto-activation notifications without clearing the target list. Kernel diagnostics such as KASAN may report a slab-out-of-bounds write involving nci_add_new_protocol, nci_ntf_packet, or nci_rx_work.