CVE-2026-80798: nfc: llcp: reject PDUs shorter than the LLCP header
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: reject PDUs shorter than the LLCP header
Every LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the receive path never checked that a frame is at least LLCPHEADERSIZE bytes before parsing it.
nfcllcprxskb() reads the header via nfcllcpptype()/nfcllcpdsap()/ nfcllcpssap(), which dereference pdu->data[0] and pdu->data[1], and a CONNECT or CC PDU then computes
tlvarraylen = skb->len - LLCPHEADERSIZE;
as a sizet and hands it to the TLV walk. When the frame is shorter than the header the subtraction wraps to a huge value and the walk runs far past the buffer, an out-of-bounds read.
A nearby NFC device can reach this without authentication; LLCP link activation happens automatically after NFC-DEP.
Guard the common receive choke point nfcllcprecv(), shared by both the target (nfcllcpdatareceived()) and initiator (nfcllcprecv()) paths, so a short skb is dropped before the rxwork worker parses it. Use pskbmaypull() rather than a skb->len test so the two header bytes are guaranteed to sit in the skb linear area even for a non-linear skb, matching how the sibling NCI and HCI receive paths validate their headers.
Reproduced with a KFENCE out-of-bounds read via /dev/virtualnci on linux-next.
Found by 0sec automated security-research tooling (https://0sec.ai).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix that ensures the NFC LLCP receive path rejects LLCP PDUs shorter than LLCP_HEADER_SIZE before parsing (guard __nfc_llcp_recv()/nfc_llcp_rx_skb() so the two header bytes are only read when present).
Linux kernel NFC LLCP nfc: llcp: reject PDUs shorter than the LLCP header = enabled/implemented
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel NFC LLCP receive path are exposed when they can communicate with a nearby NFC device. The attacker does not need authentication, and LLCP link activation occurs automatically after NFC-DEP.
What does an attacker need to send to trigger the flaw?
An attacker needs to provide an LLCP PDU shorter than the required two-byte LLCP header. This can cause header parsing and, for CONNECT or CC PDUs, TLV processing to read beyond the received buffer.
Are both NFC LLCP roles affected?
Yes. The vulnerable common receive path is shared by both target-side processing through nfc_llcp_data_received() and initiator-side processing through nfc_llcp_recv().
What behavior changes after the fix?
The common LLCP receive path drops frames that cannot provide the complete two-byte header before they reach the receive worker. The fix uses pskb_may_pull(), which also ensures the header is in the linear skb area for non-linear packets.