CVE-2026-80823: nfc: st21nfca: validate ATR_REQ length against the received frame

Published Sep 4, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate ATRREQ length against the received frame

st21nfcatmrecvatrreq() checks that the received ATRREQ frame is at least ST21NFCAATRREQMINSIZE and that the self-declared atrreq->length is at least sizeof(struct st21nfcaatrreq), but never checks that atrreq->length does not exceed the actual received length (skb->len).

st21nfcatmsendatrres() then trusts the declared length:

gblen = atrreq->length - sizeof(struct st21nfcaatrreq); ... memcpy(atrres->gbi, atrreq->gbi, gblen);

so an RF peer that sends a short frame but sets atrreq->length larger than the frame makes gblen exceed the general bytes actually present, and the memcpy reads out of bounds past the received skb. Those bytes are placed in the ATRRES and sent back to the peer (kernel-memory disclosure to a proximity attacker); a larger declared length is an out-of-bounds read (DoS).

Reject frames whose declared length exceeds the received length. The adjacent nfctmactivated() path in the same function already derives its general-bytes length from skb->len rather than the declared field.

Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 4, 2026
CVE Published
via MITRE·03:27 PM
Data Sourced
via MITRE·03:27 PM
Description

Frequently Asked Questions

1

What access does an attacker need to exploit this issue?

The attacker must be an RF peer in proximity and be able to send a crafted ATR_REQ frame. The frame is short but declares a length larger than the bytes actually received.

2

What can exploitation cause?

The out-of-bounds read can copy kernel memory into an ATR_RES response sent back to the RF peer, disclosing memory contents. A sufficiently large declared length can also cause an out-of-bounds read leading to denial of service.

3

What validation should be present to prevent exploitation?

The ATR_REQ handler must reject frames whose self-declared length exceeds the actual received frame length, skb->len. Checking only the minimum frame size and minimum declared length is insufficient.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203