CVE-2026-80799: Linux Kernel NFC LLCP Buffer Overflow

CVE-2026-80799 Overview

CVE-2026-80799 is an out-of-bounds read vulnerability in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) TLV parsers. The functions nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related parsing flaws that allow unauthenticated attackers to trigger memory disclosure and infinite loops. A u8 offset variable wraps to zero when TLV data advances past 255 bytes, and missing bounds checks permit reads of up to 255 bytes past the end of the buffer. Both functions are reachable without authentication through nfc_llcp_set_remote_gb(), which feeds remote LLCP general bytes directly into the parser.

Critical Impact
Unauthenticated attackers within NFC range can trigger kernel out-of-bounds reads and infinite parsing loops, leading to information disclosure or denial of service.

Affected Products

Linux kernel versions containing the vulnerable nfc_llcp_parse_gb_tlv() implementation
Linux kernel versions containing the vulnerable nfc_llcp_parse_connection_tlv() implementation
Distributions shipping the Linux NFC subsystem prior to the referenced stable kernel fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80799 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80799

Vulnerability Analysis

The Linux kernel's NFC LLCP subsystem parses Type-Length-Value (TLV) structures received from remote peers during link negotiation. The parsing loops in nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three distinct defects that combine to expose kernel memory.

The first defect is an integer type mismatch. The loop's offset variable is declared as u8, while tlv_array_len is u16. When cumulative TLV advancement pushes offset beyond 255, the value silently wraps to zero. This causes the loop to re-process the same buffer region indefinitely, producing a kernel-side infinite loop or repeated state changes.

The second defect is a missing header bounds check. Before reading tlv[0] (type) and tlv[1] (length), the code does not verify that offset + 2 <= tlv_array_len. A truncated TLV therefore causes a one-byte out-of-bounds read past the buffer end.

The third defect is a missing value-field bounds check. After reading the length byte, value bytes are accessed without verifying offset + 2 + length <= tlv_array_len. A crafted length of 0xFF on a short buffer results in up to 255 bytes of adjacent kernel memory being read into parser state.

Root Cause

The root cause is inadequate input validation combined with an undersized loop counter in TLV parsing code that consumes attacker-controlled network data. The parsers trust the length field and buffer contents without enforcing arithmetic that matches the declared buffer size type.

Attack Vector

An attacker within NFC radio range of a vulnerable host can send crafted LLCP general bytes during peer negotiation. nfc_llcp_set_remote_gb() passes these bytes into the parser without additional validation. No authentication or user interaction is required to reach the vulnerable code path. Consult the referenced kernel stable commits for the exact patched paths.

// Vulnerability described in prose; no verified exploit code available.
// See kernel commit references for the corrected parsing logic.

Detection Methods for CVE-2026-80799

Indicators of Compromise

Kernel log entries referencing NFC LLCP parsing errors, warnings, or KASAN out-of-bounds reports in net/nfc/llcp_commands.c or related files
Unexpected NFC subsystem CPU spikes or soft lockups on hosts with NFC hardware enabled
Repeated LLCP negotiation attempts from unknown NFC peers in proximity to affected devices

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to surface out-of-bounds reads in the NFC LLCP parsers
Monitor kernel ring buffer output (dmesg) for BUG:, WARNING:, or NFC-related stack traces referencing nfc_llcp_parse_gb_tlv or nfc_llcp_parse_connection_tlv
Inventory endpoints with active NFC hardware and the nfc kernel module loaded, since only these hosts are exposed

Monitoring Recommendations

Alert on the nfc module being loaded on systems where NFC is not a required function
Track kernel version and patch level across the fleet to identify unpatched hosts running vulnerable NFC LLCP code
Correlate physical access anomalies with kernel crash telemetry on mobile and embedded Linux endpoints that expose NFC

How to Mitigate CVE-2026-80799

Immediate Actions Required

Apply the upstream Linux kernel fixes referenced in the stable tree commits and rebuild or upgrade to a distribution kernel that includes them
Disable the nfc kernel module on hosts that do not require NFC functionality
Restrict physical proximity access to devices exposing NFC interfaces, particularly kiosks, point-of-sale systems, and shared mobile hardware

Patch Information

The fix widens offset from u8 to u16 and adds bounds checks for both the TLV header and value field before each access. The corrected code is available in multiple stable kernel commits, including 2c1456f, 2d23959, 382eaa7, 78b20c8, 7f6f3d0, 875285a, 9c47d66, a209334, and e84cdfd. Consult your distribution vendor for backported packages.

Workarounds

Blacklist the nfc and nfc_llcp modules on systems that do not use NFC, preventing the vulnerable code from being loaded
Physically disable or shield NFC hardware on high-value systems until a patched kernel is deployed
Segment devices with active NFC interfaces from sensitive data environments to limit the impact of information disclosure

bash

# Prevent the NFC subsystem from loading on hosts that do not need it
echo 'blacklist nfc' | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo 'blacklist nfc_llcp' | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
sudo update-initramfs -u
# Verify the module is not currently loaded
lsmod | grep -E 'nfc|llcp'