GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-80823

Vulnerability from fkie_nvd - Published: 2026-09-04 16:18 - Updated: 2026-09-04 16:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATR_REQ length against the received frame st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at least ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req->length is at least sizeof(struct st21nfca_atr_req), but never checks that atr_req->length does not exceed the actual received length (skb->len). st21nfca_tm_send_atr_res() then trusts the declared length: gb_len = atr_req->length - sizeof(struct st21nfca_atr_req); ... memcpy(atr_res->gbi, atr_req->gbi, gb_len); so an RF peer that sends a short frame but sets atr_req->length larger than the frame makes gb_len exceed the general bytes actually present, and the memcpy reads out of bounds past the received skb. Those bytes are placed in the ATR_RES and sent back to the peer (kernel-memory disclosure to a proximity attacker); a larger declared length is an out-of-bounds read (DoS). Reject frames whose declared length exceeds the received length. The adjacent nfc_tm_activated() path in the same function already derives its general-bytes length from skb->len rather than the declared field. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0f344944c506b4f02d2b098489f7268b438c369e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2c1ad291f4cdc357f9527b688c6fda9c6ffa7890
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/304f5b414f4051d324b8c4a3ab0e79f7dc7e150e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5cdcca5d62a66eda6b774110a44cba67bc1a8d1d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/785df00bb3ae3206674a43284eb06dac575b5c64
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9635507fe82949e429b3cd938876a9917125b151
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bfcca5f42c9aa4eadef1e5fe7bb23783d7fcc96d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd26d30f40c43ad9cfe2f25c6ea0ead1dd51d5aa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f33cecf69095c43be88567fef92b180b858f7369
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nfc/st21nfca/dep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "785df00bb3ae3206674a43284eb06dac575b5c64",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            },
            {
              "lessThan": "2c1ad291f4cdc357f9527b688c6fda9c6ffa7890",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            },
            {
              "lessThan": "dd26d30f40c43ad9cfe2f25c6ea0ead1dd51d5aa",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            },
            {
              "lessThan": "9635507fe82949e429b3cd938876a9917125b151",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            },
            {
              "lessThan": "0f344944c506b4f02d2b098489f7268b438c369e",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            },
            {
              "lessThan": "bfcca5f42c9aa4eadef1e5fe7bb23783d7fcc96d",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            },
            {
              "lessThan": "304f5b414f4051d324b8c4a3ab0e79f7dc7e150e",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            },
            {
              "lessThan": "f33cecf69095c43be88567fef92b180b858f7369",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            },
            {
              "lessThan": "5cdcca5d62a66eda6b774110a44cba67bc1a8d1d",
              "status": "affected",
              "version": "1892bf844ea0261736bd5e75546fc996e9daeedf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nfc/st21nfca/dep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate ATR_REQ length against the received frame\n\nst21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at\nleast ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req-\u003elength\nis at least sizeof(struct st21nfca_atr_req), but never checks that\natr_req-\u003elength does not exceed the actual received length (skb-\u003elen).\n\nst21nfca_tm_send_atr_res() then trusts the declared length:\n\n\tgb_len = atr_req-\u003elength - sizeof(struct st21nfca_atr_req);\n\t...\n\tmemcpy(atr_res-\u003egbi, atr_req-\u003egbi, gb_len);\n\nso an RF peer that sends a short frame but sets atr_req-\u003elength larger\nthan the frame makes gb_len exceed the general bytes actually present,\nand the memcpy reads out of bounds past the received skb. Those bytes are\nplaced in the ATR_RES and sent back to the peer (kernel-memory disclosure\nto a proximity attacker); a larger declared length is an out-of-bounds\nread (DoS).\n\nReject frames whose declared length exceeds the received length. The\nadjacent nfc_tm_activated() path in the same function already derives its\ngeneral-bytes length from skb-\u003elen rather than the declared field.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing bound is evident from source. Compile-tested."
    }
  ],
  "id": "CVE-2026-80823",
  "lastModified": "2026-09-04T16:18:10.080",
  "metrics": {},
  "published": "2026-09-04T16:18:10.080",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0f344944c506b4f02d2b098489f7268b438c369e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2c1ad291f4cdc357f9527b688c6fda9c6ffa7890"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/304f5b414f4051d324b8c4a3ab0e79f7dc7e150e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5cdcca5d62a66eda6b774110a44cba67bc1a8d1d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/785df00bb3ae3206674a43284eb06dac575b5c64"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9635507fe82949e429b3cd938876a9917125b151"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bfcca5f42c9aa4eadef1e5fe7bb23783d7fcc96d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dd26d30f40c43ad9cfe2f25c6ea0ead1dd51d5aa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f33cecf69095c43be88567fef92b180b858f7369"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.