CVE-2026-80796: Linux Kernel NFC NCI Buffer Overflow Vulnerability

CVE-2026-80796 Overview

CVE-2026-80796 is an out-of-bounds read vulnerability in the Linux kernel's Near Field Communication (NFC) Controller Interface (NCI) subsystem. The functions nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() parse an inner length byte from an RF_INTF_ACTIVATED_NTF payload and call memcpy() into fixed kernel buffers. Neither function receives the caller-validated activation_params_len value. A crafted NCI notification with activation_params_len=1 and an inner length byte up to 20 (NFC-A) or 50 (NFC-B) triggers a slab out-of-bounds read of kernel memory adjacent to the NCI socket buffer (skb).

Critical Impact
A malicious or malformed NCI notification can cause the kernel to read up to 50 bytes of adjacent slab memory, potentially leaking sensitive kernel data to attacker-controllable code paths.

Affected Products

Linux kernel versions containing the nfc/nci activation parameter extractor code prior to the fix
Systems with NFC hardware and the nci kernel module loaded
Distributions shipping kernels without the referenced stable commits backported

Discovery Timeline

2026-09-04 - CVE-2026-80796 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80796

Vulnerability Analysis

The vulnerability resides in the Linux kernel NFC NCI subsystem, which parses RF_INTF_ACTIVATED_NTF notifications from NFC controllers. The extractor functions nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() consume an inner length byte from the payload and pass it directly to memcpy() targeting fixed-size kernel buffers.

Because the extractors do not receive the caller-validated activation_params_len bound, they cannot verify that the declared inner length fits within the remaining activation parameter region. When activation_params_len=1, only a single valid byte exists, yet the extractor may copy up to 20 bytes (NFC-A) or 50 bytes (NFC-B) starting from the payload position. This constitutes a slab out-of-bounds read [CWE-125] adjacent to the NCI skb allocation.

A sibling family of functions, nci_extract_rf_params_*(), previously received equivalent bounds validation in commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter validation for packet data"). The activation parameter extractors were overlooked during that hardening effort.

Root Cause

The root cause is missing length validation between the caller and callee. The caller in ntf.c:801 validates activation_params_len against the skb, but does not propagate the bound to the extractor functions. The extractors trust an attacker-influenced inner length byte and use it as the memcpy() size without clamping it to the actual remaining bytes in the activation parameters region.

Attack Vector

Exploitation requires delivery of a crafted RF_INTF_ACTIVATED_NTF notification through the NCI transport path. An attacker capable of injecting NCI frames — via a malicious or compromised NFC controller, a manipulated USB/UART NFC transport, or through local privileged interfaces that reach the NCI parser — can trigger the out-of-bounds read. The read discloses up to 50 bytes of kernel slab memory adjacent to the NCI socket buffer, which may contain sensitive kernel structures or heap allocations useful for further exploitation.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the upstream commit references listed in the kernel stable tree.

Detection Methods for CVE-2026-80796

Indicators of Compromise

Kernel Address Sanitizer (KASAN) reports flagging slab-out-of-bounds reads originating from nci_extract_activation_params_iso_dep or nci_extract_activation_params_nfc_dep
Unexpected kernel oops or warnings tied to the nfc_nci module during NFC tag activation events
Anomalous RF_INTF_ACTIVATED_NTF payloads where the declared inner length byte exceeds the enclosing activation_params_len

Detection Strategies

Enable KASAN in test and staging kernels to surface out-of-bounds reads in NFC code paths during fuzzing
Audit installed kernel packages against the fixed commits in the Linux stable tree to identify unpatched hosts
Fuzz NCI transport inputs with tools such as syzkaller targeting the nfc subsystem to reproduce malformed activation notifications

Monitoring Recommendations

Collect kernel logs (dmesg, journalctl -k) for warnings referencing the nci module or NFC activation failures
Monitor loaded kernel modules on endpoints; alert when nci or nfc loads unexpectedly on systems that do not require NFC
Track kernel version and patch status across the fleet using configuration management to identify hosts missing the referenced stable updates

How to Mitigate CVE-2026-80796

Immediate Actions Required

Apply the kernel update from your distribution that incorporates the referenced stable commits fixing the extractor bounds checks
Where patching is delayed, unload and blacklist the nci and nfc kernel modules on systems that do not require NFC functionality
Restrict physical and local access to NFC transports on affected devices to limit adversary ability to inject crafted NCI frames

Patch Information

The fix adds a data_len parameter to both nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep(), guards against an empty region before consuming the inner length byte, decrements the remaining count after consumption, and clamps the memcpy() length to the bytes actually available. Both call sites are updated to pass ntf.activation_params_len, which is already validated against the skb at ntf.c:801. See the upstream commits including 0428fa2c22e2, 04e51353cb9f, and 9b01f5af0dc5 for the full set of stable backports.

Workarounds

Blacklist the vulnerable modules by creating /etc/modprobe.d/blacklist-nfc.conf with blacklist nci and blacklist nfc entries, then rebuild the initramfs
Disable NFC hardware in firmware or BIOS on systems where the capability is not required
Enforce module signing and restrict CAP_NET_ADMIN and CAP_SYS_MODULE privileges to limit which processes can interact with the NFC stack

bash

# Configuration example: blacklist the NFC NCI modules on systems that do not need NFC
echo 'blacklist nci' | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo 'blacklist nfc' | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
sudo update-initramfs -u
sudo modprobe -r nci nfc 2>/dev/null || true