CVE-2026-80801: nfc: microread: validate target discovery payload lengths
In the Linux kernel, the following vulnerability has been resolved:
nfc: microread: validate target discovery payload lengths
microreadtargetdiscovered() parses target discovery payloads from skb->data according to the HCI gate. The fixed field offsets and UID copies were checked only against the destination nfctarget buffers, not against the actual skb length.
Validate that each gate-specific payload contains the fixed fields and UID bytes before reading or copying them.
Affected Software
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems using the Linux kernel microread NFC driver are the relevant population. Exposure requires the driver to process target discovery payloads.
What does an attacker need to exploit the vulnerability?
An attacker would need to cause the microread driver to parse a target discovery payload that is shorter than the fields or UID bytes expected for its HCI gate. The provided information does not specify the delivery mechanism or required proximity.
What is the effect of the fix?
The fix validates that gate-specific discovery payloads contain the required fixed fields and UID bytes before the driver reads from or copies data out of the skb. This prevents parsing based on offsets that exceed the actual skb length.