CVE-2026-90226: nfc: llcp: avoid userspace overflow on invalid optlen
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: avoid userspace overflow on invalid optlen
nfcllcpgetsockopt() casts optval to (u32 user ) for putuser(), so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mint(u32, len, sizeof(u32)) only clamps the length reported back to userspace; it does not constrain the store. A call with optlen < 4 therefore writes past the user buffer, violating the getsockopt(2) contract for all five supported optnames.
Reject any call with optlen < sizeof(u32) up front. 'len' is int, so a plain size comparison would promote a negative optlen to sizet and slip past the check; an explicit 'len < 0' test is added first to catch negative values before the size compare.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix that rejects any getsockopt call with optlen < sizeof(u32) up front in nfc_llcp_getsockopt(), including an explicit 'len < 0' test before any plain size comparison to prevent negative optlen from being promoted to size_t. This prevents writing 4 bytes via put_user() past the user buffer when optlen < 4.
Linux kernel getsockopt optlen validation in nfc_llcp_getsockopt() = Reject calls where optlen < sizeof(u32) (and add an explicit len < 0 test before size comparisons)
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
They must be able to invoke getsockopt(2) on an NFC LLCP socket and supply an output buffer length smaller than 4 bytes, including a negative length. The vulnerable code affects all five supported LLCP socket option names.
What is the impact of a malformed optlen value?
The kernel writes a 4-byte u32 value to the userspace buffer even when the supplied optlen is less than 4 bytes. This can write past the caller's buffer and violates the getsockopt(2) buffer-length contract.
What behavior indicates that the fix is present?
The corrected code rejects calls where optlen is negative or smaller than sizeof(u32) before writing the option value. A valid call must provide an output length of at least 4 bytes.