GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-80803

Vulnerability from fkie_nvd - Published: 2026-09-04 16:18 - Updated: 2026-09-04 16:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target. Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy. Found by 0sec automated security-research tooling (https://0sec.ai).
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/31aa28ed732f66ab83c40ef53d99791be69b85c4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4e942da2869bcd646353eef706b7dd82efeb9db5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6afb29751ee731e7f7a96feb8a15f91441e552ba
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a56773e649ea99b344d6bbaf90f34c8e3fadef5d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/af4c0606f743e009254a8d252096855335ade85d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d0756a98277e383c26fead988a96c91f0781cd7f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e886c63d2ca7108826076989103a1ffa8a0bb8f4
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/digital_technology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6afb29751ee731e7f7a96feb8a15f91441e552ba",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            },
            {
              "lessThan": "e886c63d2ca7108826076989103a1ffa8a0bb8f4",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            },
            {
              "lessThan": "4e942da2869bcd646353eef706b7dd82efeb9db5",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            },
            {
              "lessThan": "d0756a98277e383c26fead988a96c91f0781cd7f",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            },
            {
              "lessThan": "af4c0606f743e009254a8d252096855335ade85d",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            },
            {
              "lessThan": "a56773e649ea99b344d6bbaf90f34c8e3fadef5d",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            },
            {
              "lessThan": "a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            },
            {
              "lessThan": "31aa28ed732f66ab83c40ef53d99791be69b85c4",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            },
            {
              "lessThan": "344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16",
              "status": "affected",
              "version": "8c0695e4998dd268ff2a05951961247b7e015651",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/digital_technology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: digital: clamp SENSF_RES length to the destination buffer\n\ndigital_in_recv_sensf_res() memcpy()s resp-\u003elen bytes from a remote\nNFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res\nfield without an upper-bound check. A nearby malicious NFC-F device can\nsend an oversized SENSF_RES response to overflow the stack-local struct\nnfc_target.\n\nClamp resp-\u003elen to NFC_SENSF_RES_MAXSIZE before the copy.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
    }
  ],
  "id": "CVE-2026-80803",
  "lastModified": "2026-09-04T16:18:07.250",
  "metrics": {},
  "published": "2026-09-04T16:18:07.250",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/31aa28ed732f66ab83c40ef53d99791be69b85c4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4e942da2869bcd646353eef706b7dd82efeb9db5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6afb29751ee731e7f7a96feb8a15f91441e552ba"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a56773e649ea99b344d6bbaf90f34c8e3fadef5d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/af4c0606f743e009254a8d252096855335ade85d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d0756a98277e383c26fead988a96c91f0781cd7f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e886c63d2ca7108826076989103a1ffa8a0bb8f4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.