CVE-2026-80800: Linux Kernel NFC LLCP Buffer Overflow

CVE-2026-80800 Overview

CVE-2026-80800 is an out-of-bounds read vulnerability in the Linux kernel Near Field Communication (NFC) Logical Link Control Protocol (LLCP) subsystem. The flaw resides in the nfc_llcp_connect_sn() function, which parses Type-Length-Value (TLV) fields from received CONNECT and CC Protocol Data Units (PDUs) without validating that headers or declared lengths remain within the socket buffer (skb). A nearby NFC-capable device can reach the vulnerable code path without authentication because LLCP link activation occurs automatically after NFC Data Exchange Protocol (NFC-DEP) negotiation.

Critical Impact
An unauthenticated attacker within NFC radio range can trigger an out-of-bounds read in kernel memory, enabling information disclosure or denial of service on affected Linux systems.

Affected Products

Linux kernel with NFC LLCP support enabled
Multiple stable kernel branches (see referenced stable commits)
Systems with active NFC hardware and drivers loaded

Discovery Timeline

2026-09-04 - CVE-2026-80800 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80800

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the NFC LLCP TLV parser. The nfc_llcp_connect_sn() function walks a TLV list by reading a two-byte header (type and length) followed by length bytes of value data. The function does not verify that either the header bytes or the declared payload length stay within the received skb buffer. As a result, the parser can return a pointer to a service name of up to 255 bytes that extends beyond the buffer boundary. This pointer is subsequently consumed by memcmp() inside nfc_llcp_sock_from_sn(), reading uninitialized or adjacent kernel memory.

A second defect compounds the issue. The parser computes tlv_array_len as skb->len - LLCP_HEADER_SIZE using size_t arithmetic. A CONNECT or CC frame shorter than the LLCP header underflows this subtraction to a very large value, causing the TLV walk to run far past the end of the buffer.

Root Cause

The root cause is missing bounds validation on attacker-controlled length fields during TLV parsing, combined with an unsigned integer underflow when the frame is shorter than LLCP_HEADER_SIZE. Sibling parsers nfc_llcp_recv_snl(), nfc_llcp_parse_gb_tlv(), and nfc_llcp_parse_connection_tlv() were previously hardened by earlier commits, but nfc_llcp_connect_sn() retained the same unsafe pattern.

Attack Vector

The vulnerable code is reachable from nfc_llcp_recv_connect() and nfc_llcp_recv_cc(), which process inbound CONNECT and CC PDUs. An attacker only needs to be within NFC proximity of the target device. LLCP link activation runs automatically after NFC-DEP negotiation, and the nfc_llcp_rx_skb() dispatcher does not enforce a minimum-length guard. No authentication, user interaction, or elevated privileges are required.

Refer to the Linux kernel stable commit 0cfbdb0 for the patch that bounds the TLV walk by skb_tail_pointer(skb) and validates each declared length before use.

Detection Methods for CVE-2026-80800

Indicators of Compromise

Unexpected kernel oops or KASAN out-of-bounds read reports referencing nfc_llcp_connect_sn, nfc_llcp_recv_connect, or nfc_llcp_sock_from_sn in dmesg.
NFC subsystem crashes or module faults on systems with active NFC radios.
Malformed LLCP CONNECT or CC PDUs observed on NFC interfaces where such traffic is not expected.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface the out-of-bounds read during fuzzing or exposure testing.
Monitor kernel logs for stack traces originating in net/nfc/llcp_commands.c and net/nfc/llcp_core.c.
Inventory endpoints with the nfc and nfc_llcp modules loaded to identify systems where the attack surface is active.

Monitoring Recommendations

Collect and centralize kernel logs from Linux endpoints to a Security Information and Event Management (SIEM) platform for correlation.
Alert on nfc module load events on systems that should not use NFC.
Track kernel version and patch level across the fleet to identify unpatched hosts.

How to Mitigate CVE-2026-80800

Immediate Actions Required

Apply the stable kernel updates that include the fix for nfc_llcp_connect_sn() across all affected branches.
On systems that do not require NFC, unload the nfc and nfc_llcp kernel modules and blacklist them.
Physically disable NFC hardware on devices where the feature is not needed.

Patch Information

The fix walks the TLV list by pointer against skb_tail_pointer(skb), validates each declared length before use, and starts the walk at &skb->data[LLCP_HEADER_SIZE] to eliminate the size_t underflow. Patches were released across multiple stable branches. See the Kernel Stable Commit 0cfbdb0, Kernel Stable Commit 1964add, Kernel Stable Commit 22e5177, Kernel Stable Commit 389986f, Kernel Stable Commit 55c68ac, Kernel Stable Commit 65a0ec7, Kernel Stable Commit b2ebdfe, Kernel Stable Commit e18d044, and Kernel Stable Commit e87527b.

Workarounds

Blacklist the NFC modules to prevent automatic loading on hosts that do not need NFC.
Restrict physical access so untrusted devices cannot approach systems within NFC range.
Disable NFC via firmware or hardware switches where supported.

bash

# Prevent NFC modules from loading on systems that do not require NFC
echo 'blacklist nfc' | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo 'blacklist nfc_llcp' | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
sudo modprobe -r nfc_llcp nfc 2>/dev/null
sudo update-initramfs -u