CVE-2026-63915: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63915 Overview

CVE-2026-63915 is an out-of-bounds read vulnerability in the Linux kernel's Near Field Communication (NFC) Host Controller Interface (HCI) subsystem. The flaw resides in the nfc_hci_recv_from_llc() and nci_hci_data_received_cb() functions, which read packet->header from skb->data without verifying that the socket buffer contains at least one byte. A malicious NFC peer can transmit a 0-byte Host Controller Protocol (HCP) frame that traverses the Simplified High-Level Data Link Control (SHDLC) layer and reaches these functions. The vulnerability also causes reassembly loop underflow of msg_len to UINT_MAX, triggering skb_over_panic().

Critical Impact
An adjacent-network attacker with NFC range can trigger a kernel panic or heap out-of-bounds read, leading to denial of service or potential information disclosure on affected Linux systems.

Affected Products

Linux kernel — NFC HCI subsystem (net/nfc/hci/)
Linux kernel — NCI HCI subsystem (net/nfc/nci/hci.c)
Distributions shipping vulnerable kernel versions prior to the referenced stable patches

Discovery Timeline

2026-07-19 - CVE-2026-63915 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63915

Vulnerability Analysis

The vulnerability affects two entry points in the Linux kernel NFC stack: nfc_hci_recv_from_llc() and nci_hci_data_received_cb(). Both functions dereference packet->header directly from skb->data without validating that the socket buffer holds at least one byte. When an attacker sends a 0-byte HCP frame, the SHDLC layer passes the empty buffer upward, causing an out-of-bounds heap read at the first byte access.

A secondary defect occurs during HCP fragment reassembly. When a 0-byte frame is queued as a non-final fragment, the reassembly loop subtracts from msg_len, causing an unsigned integer underflow to UINT_MAX. The subsequent skb_put() on the reassembled buffer then triggers skb_over_panic(), halting the kernel.

Root Cause

The root cause is missing input validation on incoming socket buffers before header dereference. The affected functions assume the SHDLC layer guarantees a minimum payload length, but no such guarantee exists. The fix adds pskb_may_pull() checks at each function entry to ensure at least one byte is present before packet->header is accessed. Existing pskb_may_pull() checks that guard the 2-byte HCP message header on the reassembled hcp_skb remain in place.

Attack Vector

Exploitation requires the attacker to be within NFC radio range of a target device with an active NFC controller. The attacker crafts a malformed HCP frame containing zero payload bytes and transmits it through the NFC link. The frame passes SHDLC framing validation and reaches the vulnerable handler, where the out-of-bounds read or reassembly underflow occurs. No authentication or user interaction is required on the target.

No verified public proof-of-concept code is available. See the Kernel Patch 1905f5e and Kernel Patch f040e59 for the code-level fix details.

Detection Methods for CVE-2026-63915

Indicators of Compromise

Kernel panic messages referencing skb_over_panic() originating from NFC HCI reassembly paths
KASAN reports flagging out-of-bounds heap reads in nfc_hci_recv_from_llc() or nci_hci_data_received_cb()
Unexpected NFC subsystem crashes or hangs on devices with NFC hardware enabled

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to catch the out-of-bounds read at runtime
Monitor kernel ring buffer (dmesg) for skb_over_panic or NFC-related oops traces
Audit installed kernel versions against the fixed stable branches referenced in the kernel patches

Monitoring Recommendations

Collect kernel crash dumps and forward them to a centralized logging platform for correlation
Track NFC controller activity on endpoints where NFC is not required for business function
Alert on repeated kernel oops events from the net/nfc/ code paths

How to Mitigate CVE-2026-63915

Immediate Actions Required

Apply the upstream Linux kernel patches from kernel.org stable trees to all systems with NFC hardware enabled
Disable the NFC subsystem on devices where NFC functionality is not required using module blacklisting
Restrict physical proximity to sensitive devices, as exploitation requires adjacent-network (NFC-range) access

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Reference commits include 1905f5e, 22d41b1, 3738229, 83b1362, b99366d, c4cc6b3, ed6d5d9, and f040e59. Each patch adds a pskb_may_pull() check at the entry of nfc_hci_recv_from_llc() and nci_hci_data_received_cb() before packet->header is dereferenced. See the Kernel Patch 22d41b1 and Kernel Patch 3738229 for backport details across supported stable branches.

Workarounds

Blacklist the nfc, nci, and related NFC driver modules on systems that do not require NFC functionality
Unload NFC kernel modules at runtime with rmmod and add persistent blacklist entries in /etc/modprobe.d/
Physically disable NFC hardware via firmware or BIOS settings where the option is available

bash

# Configuration example: blacklist NFC modules to mitigate CVE-2026-63915
echo "blacklist nfc"       | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo "blacklist nci"       >> /etc/modprobe.d/blacklist-nfc.conf
echo "blacklist nfc_hci"   >> /etc/modprobe.d/blacklist-nfc.conf

# Unload currently loaded modules
sudo rmmod nfc_hci 2>/dev/null
sudo rmmod nci     2>/dev/null
sudo rmmod nfc     2>/dev/null

# Verify
lsmod | grep -E 'nfc|nci'