CVE-2026-31622: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31622 Overview

CVE-2026-31622 is a heap buffer overflow vulnerability in the Linux kernel's NFC digital protocol stack [CWE-120]. The flaw resides in digital_in_recv_sdd_res(), which handles NFC-A anti-collision Single Device Detection (SDD) responses. The function appends 3 or 4 bytes to target->nfcid1 on each cascade round without validating the total accumulated length. A malicious NFC peer can drive an unbounded number of cascade rounds, writing past the fixed-size NFC_NFCID1_MAXSIZE (10 bytes) buffer in the heap-allocated nfc_target structure.

Critical Impact
An adjacent attacker with NFC range to a vulnerable Linux device can corrupt kernel heap memory, potentially leading to kernel code execution or denial of service.

Affected Products

Linux Kernel (NFC digital driver subsystem)
Distributions shipping affected stable kernel branches prior to the fix commits
Systems with NFC hardware exposing the digital protocol stack

Discovery Timeline

2026-04-24 - CVE-2026-31622 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31622

Vulnerability Analysis

The NFC-A anti-collision protocol uses a cascade mechanism to resolve target Unique Identifiers (UIDs). Each cascade level returns either 3 bytes plus a cascade tag indicating more levels follow, or 4 bytes representing the final portion. ISO 14443-3 caps NFC-A at three cascade levels, sizing target->nfcid1 to 10 bytes via NFC_NFCID1_MAXSIZE.

The driver function digital_in_recv_sdd_res() trusts peer-controlled fields to determine cascade behavior. The peer sets the cascade tag in the SDD_RES frame, controlling whether 3 or 4 bytes get appended. It also controls the cascade-incomplete bit in the SEL_RES frame, deciding whether another cascade round follows. No driver-side check enforces the three-level ISO limit.

A related issue on the NCI path was previously addressed by commit e329e71013c9 ("NFC: nci: Bounds check struct nfc_target arrays"), but the equivalent check was missing in the digital protocol path.

Root Cause

The root cause is missing bounds validation on attacker-controlled cascade depth. The driver concatenates UID fragments into a fixed-size buffer using a loop count derived entirely from peer-supplied protocol fields. This is a classic heap buffer overflow [CWE-120] where the trust boundary between hardware peer and kernel memory is improperly enforced.

Attack Vector

Exploitation requires proximity within NFC range (typically less than 10 cm) to a target device with an active NFC reader. No authentication or user interaction is required. A rogue NFC tag emulator or hostile NFC device repeatedly sets the cascade tag and cascade-incomplete bit, forcing the kernel to append additional UID bytes past the buffer boundary. Each round writes 3 or 4 bytes into adjacent heap memory.

The fix rejects any SDD response where the accumulated UID length would exceed NFC_NFCID1_MAXSIZE. See the kernel patch commit 1bec569 for the canonical fix.

Detection Methods for CVE-2026-31622

Indicators of Compromise

Unexpected kernel oops, panic, or slab-out-of-bounds KASAN reports referencing digital_in_recv_sdd_res or nfc_target in stack traces
Repeated NFC polling sessions with anomalous cascade lengths logged by the NFC subsystem
Heap corruption symptoms (random crashes, memory allocator warnings) on devices with active NFC interfaces

Detection Strategies

Monitor dmesg and journalctl -k for NFC subsystem warnings and KASAN reports involving nfcid1 writes
Audit running kernel versions across the fleet against the stable kernel commits listed in the advisory
Use kernel runtime integrity tooling to flag corruption in NFC-related heap objects

Monitoring Recommendations

Inventory all Linux endpoints with NFC hardware enabled and the nfc kernel module loaded
Correlate NFC driver activity with proximity-based access events in physical security logs
Track package update status for kernel updates across distributions shipping NFC support

How to Mitigate CVE-2026-31622

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the advisory to all affected systems
Where patching is not immediate, unload the NFC digital driver module on systems that do not require NFC functionality
Disable NFC hardware in BIOS/UEFI or via systemd-rfkill on devices where the feature is unused

Patch Information

The upstream fix adds a bounds check that rejects any SDD response producing an accumulated UID larger than NFC_NFCID1_MAXSIZE. Patches are available across stable kernel branches via commits 1bec569, 2819f34, 46ce8be, 5a59bf7, 8d9d9bf, and cc024a3.

Workarounds

Blacklist the nfc and nfc_digital kernel modules on systems that do not need NFC
Physically disable or shield NFC antennas on critical endpoints until kernels are patched
Restrict physical access to devices with NFC hardware to reduce exposure to adjacent-network exploitation

bash

# Configuration example: blacklist NFC kernel modules
echo 'blacklist nfc' | sudo tee /etc/modprobe.d/disable-nfc.conf
echo 'blacklist nfc_digital' | sudo tee -a /etc/modprobe.d/disable-nfc.conf
sudo modprobe -r nfc_digital nfc 2>/dev/null
sudo update-initramfs -u