CVE-2026-80798: Linux Kernel NFC LLCP Buffer Overflow

CVE-2026-80798 Overview

CVE-2026-80798 is an out-of-bounds read vulnerability in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) receive path. The flaw exists because the kernel never validates that an incoming LLCP Protocol Data Unit (PDU) contains at least the two-byte LLCP header before parsing it. When a CONNECT or CC PDU is shorter than LLCP_HEADER_SIZE, the length subtraction wraps as a size_t, producing a huge value that drives the Type-Length-Value (TLV) walk far past the socket buffer. A nearby NFC device can trigger the condition without authentication because LLCP link activation occurs automatically after NFC-DEP negotiation.

Critical Impact
An unauthenticated attacker within NFC range can trigger an out-of-bounds read in the Linux kernel, potentially leading to information disclosure or kernel instability.

Affected Products

Linux kernel (mainline and stable branches receiving the referenced backports)
Linux distributions shipping vulnerable nfc/llcp subsystem builds
Systems with NFC hardware and the nfc kernel module loaded

Discovery Timeline

2026-09-04 - CVE-2026-80798 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database
Reported by 0sec automated security-research tooling, reproduced via /dev/virtual_nci on linux-next with KFENCE

Technical Details for CVE-2026-80798

Vulnerability Analysis

Every LLCP PDU begins with a two-byte header containing the Destination Service Access Point (DSAP), Source Service Access Point (SSAP), and Payload Type (PTYPE). The receive path in nfc_llcp_rx_skb() reads this header through nfc_llcp_ptype(), nfc_llcp_dsap(), and nfc_llcp_ssap(), each of which dereferences pdu->data[0] and pdu->data[1] without any prior length check.

For CONNECT and CC PDUs, the code then computes tlv_array_len = skb->len - LLCP_HEADER_SIZE as a size_t. When skb->len is less than LLCP_HEADER_SIZE, the unsigned subtraction underflows to a very large value. The subsequent TLV walk uses this length as a bound and reads memory far beyond the socket buffer's linear area. The bug was reproduced as a KFENCE-detected out-of-bounds read through the virtual NCI interface.

Root Cause

The root cause is a missing length validation combined with an unsigned integer underflow [CWE-125, CWE-191]. The NFC LLCP receive code trusts that any skb reaching the parser already contains at least the header bytes, but no earlier layer enforces this invariant. Sibling NFC receive paths for the NFC Controller Interface (NCI) and Host Controller Interface (HCI) already validate their headers, making the LLCP path an outlier.

Attack Vector

An attacker within NFC proximity of a vulnerable device can send a malformed LLCP frame shorter than two bytes. Because LLCP link activation happens automatically after NFC-DEP setup, no user interaction or authentication is required. The malformed frame is processed by the rx_work worker, triggering the out-of-bounds read in kernel context.

No synthetic exploitation code is provided. Refer to the upstream commits linked in the References section for the exact code paths and fix.

Detection Methods for CVE-2026-80798

Indicators of Compromise

Kernel Address Sanitizer (KASAN) or KFENCE reports referencing nfc_llcp_rx_skb, __nfc_llcp_recv, or the LLCP TLV parsing routines
Unexpected oops, warnings, or panics originating from the nfc/llcp subsystem in dmesg or journalctl -k
Anomalous NFC activity on systems where NFC is not part of normal operation

Detection Strategies

Monitor kernel logs for crashes, KASAN splats, or slab-out-of-bounds reports involving net/nfc/llcp_core.c
Audit systems for the presence and load state of the nfc and nfc_digital kernel modules where not required
Correlate NFC interface activity with kernel error events using a centralized log platform

Monitoring Recommendations

Forward kernel and audit logs to a central analytics platform such as Singularity Data Lake and alert on faults in the nfc/llcp code path
Track kernel package versions across the fleet to identify hosts still running vulnerable builds
Establish baseline NFC usage per host and flag deviations, particularly on servers and IoT devices where NFC should be disabled

How to Mitigate CVE-2026-80798

Immediate Actions Required

Apply the upstream Linux kernel patches referenced below and reboot affected systems
On hosts that do not require NFC, unload and blacklist the nfc module to eliminate the attack surface
Restrict physical access to devices with active NFC hardware, since the attack requires NFC proximity

Patch Information

The fix guards the common receive choke point __nfc_llcp_recv(), which is shared by the target path (nfc_llcp_data_received()) and the initiator path (nfc_llcp_recv()). Short skbs are dropped before the rx_work worker parses them. The patch uses pskb_may_pull() rather than a plain skb->len check so the two header bytes are guaranteed to be in the skb's linear area, matching how NCI and HCI receive paths validate their headers. See the upstream commits: 3793d76, 95674f50, a7b9b44, ae5f20f5, d3d90243, e6ec76a6, e969e984, eab47618, and f36cffea.

Workarounds

Blacklist the nfc kernel module on systems that do not use NFC functionality
Physically disable or remove NFC controllers where feasible
Limit the ability of unprivileged users to open /dev/virtual_nci or similar NFC interfaces via device permissions

bash

# Disable and blacklist the NFC kernel module on systems that do not need NFC
sudo modprobe -r nfc nfc_digital 2>/dev/null || true
echo -e 'blacklist nfc\nblacklist nfc_digital' | sudo tee /etc/modprobe.d/disable-nfc.conf
sudo update-initramfs -u

# Verify current kernel version after patching
uname -r