CVE-2026-80803: nfc: digital: clamp SENSF_RES length to the destination buffer
In the Linux kernel, the following vulnerability has been resolved:
nfc: digital: clamp SENSFRES length to the destination buffer
digitalinrecvsensfres() memcpy()s resp->len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSFRES response to overflow the stack-local struct nfctarget.
Clamp resp->len to NFCSENSFRESMAXSIZE before the copy.
Found by 0sec automated security-research tooling (https://0sec.ai).
Affected Software
Event History
Frequently Asked Questions
What attacker access is required to exploit this issue?
An attacker needs to operate a malicious NFC-F device near the affected system and provide an oversized SENSF_RES response.
What should be checked when validating that the fix is present?
The response length must be limited to NFC_SENSF_RES_MAXSIZE before it is used to copy data into the target.sensf_res destination buffer.
Where are the referenced remediation commits available?
The listed stable-kernel commits are 6afb29751ee731e7f7a96feb8a15f91441e552ba, e886c63d2ca7108826076989103a1ffa8a0bb8f4, and 4e942da2869bcd646353eef706b7dd82efeb9db5.