CVE-2026-80795: Linux Kernel NFC NCI Buffer Overflow Vulnerability

CVE-2026-80795 Overview

CVE-2026-80795 is an out-of-bounds write vulnerability in the Linux kernel's Near Field Communication (NFC) Controller Interface (NCI) subsystem. The flaw resides in the nci_target_auto_activated() function, which appends a target to the fixed-size ndev->targets[NCI_MAX_DISCOVERED_TARGETS] array and increments ndev->n_targets without first verifying that the array is full. A malicious or malfunctioning NFC Controller (NFCC) that repeatedly re-runs discovery and reports auto-activated targets can push n_targets beyond the limit, causing a slab out-of-bounds write detected by KASAN.

Critical Impact
A crafted NFC controller can trigger a kernel slab out-of-bounds write, leading to memory corruption, kernel panic, or potential local privilege escalation on affected Linux systems.

Affected Products

Linux kernel — NFC NCI subsystem (net/nfc/nci/)
Multiple stable kernel branches referenced by the upstream patches
Distributions shipping kernels that predate the fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80795 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in the NVD database

Technical Details for CVE-2026-80795

Vulnerability Analysis

The vulnerability is a slab out-of-bounds write [CWE-787] in the Linux kernel NCI driver. The nci_target_auto_activated() function handles NFC target auto-activation events from an NFC Controller. Unlike its sibling nci_add_new_target(), which correctly bails out when n_targets already equals NCI_MAX_DISCOVERED_TARGETS, the auto-activation path performs no such bounds check before appending a struct nfc_target and incrementing the counter.

Because ndev->n_targets is only cleared by nci_clear_target_list(), an NFCC that repeatedly issues RF_DISCOVER_RSP (which re-enters NCI_DISCOVERY without clearing the target list) followed by RF_INTF_ACTIVATED_NTF can push n_targets past the array limit. Each subsequent auto-activated target is written past the end of the fixed-size array. Downstream, nfc_targets_found() walks the array using the inflated count, extending the corruption window.

Root Cause

The root cause is a missing bounds check on the ndev->n_targets counter before performing an array append in nci_target_auto_activated(). The sibling function nci_add_new_target() correctly gates the append on the same counter but that check was never added to the auto-activation path, producing inconsistent input validation across two related code paths.

Attack Vector

Exploitation requires a malicious or compromised NFC controller device or firmware that speaks the NCI protocol to the Linux host. By repeatedly emitting RF_DISCOVER_RSP notifications (which re-enter discovery without clearing the target list) and then delivering RF_INTF_ACTIVATED_NTF notifications, the peripheral drives n_targets beyond NCI_MAX_DISCOVERED_TARGETS. The kernel then writes a struct nfc_target past the end of the allocated buffer. The KASAN report shows the write occurring in nci_add_new_protocol+0x94/0x2ac from the nci_rx_work workqueue context, 1024 bytes to the right of a 1560-byte allocation in the kmalloc-2k slab cache.

No verified public proof-of-concept code is available. Technical detail is available in the upstream commits, including Kernel Patch 0dc59de0075f and Kernel Patch 94530ffabfca.

Detection Methods for CVE-2026-80795

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in nci_add_new_protocol or nci_target_auto_activated originating from the nci_rx_work workqueue.
Unexpected kernel oops, panic, or slab corruption warnings on hosts with NFC hardware enabled.
Anomalous NCI traffic patterns showing repeated RF_DISCOVER_RSP followed by many RF_INTF_ACTIVATED_NTF messages from a single controller.

Detection Strategies

Enable KASAN on test and staging kernels to catch the out-of-bounds write during fuzzing or hardware bring-up.
Audit installed kernel versions against the fix commits listed in the upstream references to identify unpatched hosts.
Correlate dmesg/journalctl kernel log entries mentioning nci, nfc_targets_found, or KASAN across the fleet.

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on KASAN or oops signatures tied to the NCI subsystem.
Track kernel version and patch level across endpoints to surface hosts still exposed to CVE-2026-80795.
Monitor USB/serial NFC device attach events on servers or endpoints where NFC hardware is not expected.

How to Mitigate CVE-2026-80795

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry to any Linux system running the NFC NCI stack.
Where patching is not immediately possible, unload the nci and nfc kernel modules and blocklist them on systems that do not require NFC.
Restrict physical access to systems with attached or embedded NFC controllers to reduce the ability of an attacker to substitute malicious hardware.

Patch Information

The upstream fix guards nci_target_auto_activated() with the same n_targets < NCI_MAX_DISCOVERED_TARGETS check used by nci_add_new_target(). The patch is available across multiple stable branches, including Kernel Patch 0dc59de0075f, Kernel Patch 129032c0616d, Kernel Patch 24761d3a5f69, Kernel Patch 2f08dbce3b37, Kernel Patch 50e87e1c0e18, Kernel Patch 94530ffabfca, Kernel Patch ac200079db50, Kernel Patch afd8605fb43b, and Kernel Patch d7083f41c21b. Rebuild and reboot into the patched kernel to close the exposure.

Workarounds

Blocklist the nci and nfc kernel modules on hosts that do not require NFC functionality.
Disable NFC hardware in firmware or BIOS where the platform exposes such an option.
Enforce hardware allowlisting on USB and internal buses to prevent unknown NFC controllers from binding to the driver.

bash

# Blocklist NFC and NCI modules to prevent load
cat <<'EOF' | sudo tee /etc/modprobe.d/blocklist-nfc.conf
blacklist nci
blacklist nfc
install nci /bin/true
install nfc /bin/true
EOF

# Unload if currently loaded
sudo modprobe -r nci nfc || true

# Rebuild initramfs so the blocklist applies at boot
sudo update-initramfs -u