CVE-2026-80794: Linux Kernel NFC Information Disclosure

CVE-2026-80794 Overview

CVE-2026-80794 is an uninitialized memory use vulnerability in the Linux kernel's Near Field Communication (NFC) Controller Interface (NCI) subsystem. The flaw resides in nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet(), which parse RF notifications into on-stack structures without initialisation. When a notification reports a zero-length rf_tech_specific_params_len, the parameter union remains uninitialised. The handlers then pass the structure to nci_add_new_protocol(), which copies nfcid1, sens_res, and sel_res values into ndev->targets. This target data is subsequently exposed to userspace via the NFC_CMD_GET_TARGET netlink command, leaking kernel stack memory.

Critical Impact
Kernel stack memory contents can leak to userspace through the NFC target enumeration interface, potentially disclosing sensitive data useful for further exploitation.

Affected Products

Linux kernel builds containing the vulnerable net/nfc/nci/ntf.c handlers
Distributions shipping NFC subsystem support with NCI enabled
Kernel branches prior to the fix commits listed in the stable tree

Discovery Timeline

2026-09-04 - CVE-2026-80794 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80794

Vulnerability Analysis

The vulnerability is an Uninitialized Memory Use issue in the Linux kernel NFC NCI notification handling path. Both nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() declare local struct nci_rf_discover_ntf and struct nci_rf_intf_activated_ntf variables on the stack. These structures contain a rf_tech_specific_params union that only gets populated when the notification's rf_tech_specific_params_len field is non-zero.

When a controller returns a notification with a zero-length parameter block, the union retains whatever stack contents existed prior to the function call. The handler then invokes nci_add_new_protocol(), which reads nfca_poll->nfcid1_len as both a length check and a memcpy() size. The uninitialised length value determines how many bytes of stack memory get copied into ndev->targets.

The copied bytes, along with sens_res and sel_res fields, become accessible to userspace via the NFC_CMD_GET_TARGET netlink command. KMSAN identified the flaw with a report showing the uninit-value originating in nci_add_new_protocol+0x624/0x6c0.

Root Cause

The root cause is missing zero-initialisation of on-stack notification structures. The code assumes downstream consumers will honour the rf_tech_specific_params_len guard, but nci_add_new_protocol() inspects union members without re-checking the outer length field.

Attack Vector

Exploitation requires a malicious or malfunctioning NFC controller, or a compromised local component capable of injecting crafted NCI notifications. An attacker delivering a notification with rf_tech_specific_params_len set to zero triggers the leak. Subsequent invocation of NFC_CMD_GET_TARGET from userspace returns kernel stack bytes.

The fix is straightforward: zero-initialise both on-stack notifications so the union reads back as zero when no technology-specific parameters are present. Applied commits include 0d4b5cf, 1007a6b, 4bda9ef, 5bd00c0, 7086dab, 7489f59, 8cbe06c, d6f743d, and fe69fed.

Detection Methods for CVE-2026-80794

Indicators of Compromise

Unexpected NFC_CMD_GET_TARGET netlink queries originating from unprivileged processes
KMSAN or KASAN reports referencing nci_add_new_protocol in kernel logs on instrumented builds
Anomalous NCI notification traffic reporting zero-length RF technology-specific parameters

Detection Strategies

Enable KMSAN on test kernels to surface uninit-value reads in the NFC subsystem
Audit kernel version strings across the fleet against the stable commits that carry the fix
Monitor dmesg for NFC subsystem warnings correlated with device enumeration events

Monitoring Recommendations

Collect kernel logs centrally and alert on NFC or NCI subsystem anomalies
Track use of the netlink NFC_GENL_NAME family on hosts that do not require NFC functionality
Inventory endpoints with NFC hardware and prioritise them for patch rollout tracking

How to Mitigate CVE-2026-80794

Immediate Actions Required

Apply the upstream Linux stable kernel updates that include the initialisation fix
Disable and blacklist the nfc and nci kernel modules on systems that do not require NFC
Restrict access to the NFC netlink interface to privileged processes only

Patch Information

The fix zero-initialises the on-stack nci_rf_discover_ntf and nci_rf_intf_activated_ntf structures in net/nfc/nci/ntf.c. Merged commits across stable branches include 0d4b5cf, 1007a6b, 4bda9ef, 5bd00c0, 7086dab, 7489f59, 8cbe06c, d6f743d, and fe69fed. Consult your distribution's advisory feed for backport availability.

Workarounds

Unload the NFC modules with modprobe -r nci nfc where the feature is unused
Add install nci /bin/true and install nfc /bin/true to a modprobe configuration file to prevent automatic load
Constrain physical access to hosts with NFC hardware pending patch deployment

bash

# Configuration example
echo 'install nfc /bin/true' | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo 'install nci /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
sudo modprobe -r nci nfc 2>/dev/null || true
sudo update-initramfs -u