CVE-2026-80801: Linux Kernel NFC Information Disclosure

CVE-2026-80801 Overview

CVE-2026-80801 is a Linux kernel vulnerability in the Near Field Communication (NFC) microread driver. The microread_target_discovered() function parses target discovery payloads from skb->data based on the Host Controller Interface (HCI) gate. The driver validated fixed field offsets and UID copies only against the destination nfc_target buffers, not against the actual socket buffer length. A malformed or truncated payload can cause the driver to read beyond the end of skb->data. The fix validates that each gate-specific payload contains the fixed fields and UID bytes before reading or copying them.

Critical Impact
An out-of-bounds read in the kernel NFC path may leak adjacent memory or trigger kernel instability when processing untrusted NFC target discovery frames.

Affected Products

Linux kernel — drivers/nfc/microread NFC driver
Upstream kernel branches prior to the fix commits listed by kernel.org
Long-term stable kernel trees backporting the microread fix

Discovery Timeline

2026-09-04 - CVE-2026-80801 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80801

Vulnerability Analysis

The microread driver supports NXP MicroRead NFC controllers over HCI. When a target is discovered, the driver dispatches to microread_target_discovered(), which decodes a payload delivered in a socket buffer (skb). The decoding path selects fixed offsets for protocol-specific fields such as SENS_RES, SEL_RES, ATQB, and UID bytes, then copies them into the nfc_target structure.

The original code sized its bounds checks against the destination fields inside nfc_target. It did not confirm that skb->len was large enough to contain the fields being read. When a shorter-than-expected payload arrives on the HCI gate, the driver dereferences memory past the end of the received frame.

The fix adds per-gate length validation before any field access or UID copy, rejecting payloads that do not carry the expected number of bytes.

Root Cause

The root cause is improper input validation [CWE-125-style out-of-bounds read] in a kernel driver parsing an externally supplied length-variable message. Fixed offset arithmetic was performed on skb->data without first checking skb->len against the required minimum for the selected HCI gate.

Attack Vector

Exploitation requires the ability to deliver a crafted NFC target discovery frame to a system running the microread driver. This is a local, adjacent-hardware attack surface: the attacker must be within NFC range of a vulnerable device or otherwise inject frames into the HCI transport. Successful triggering causes an out-of-bounds read of kernel memory, potentially resulting in information disclosure or a kernel crash.

No verified public exploit is available. Refer to the upstream kernel commits, including Kernel Commit 18f02354 and Kernel Commit e6397fe7, for the exact code paths modified by the fix.

Detection Methods for CVE-2026-80801

Indicators of Compromise

Unexpected kernel oops, KASAN slab-out-of-bounds reports, or panics originating in microread_target_discovered or adjacent NFC HCI functions.
dmesg entries referencing the microread driver correlated with NFC activity from untrusted tags or readers.
Repeated NFC target discovery events from devices outside normal operational patterns.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test builds to surface the out-of-bounds read during fuzzing of NFC HCI payloads.
Monitor kernel logs for microread warnings, oopses, or driver resets on systems that expose NFC hardware.
Track running kernel versions across the fleet and flag hosts with vulnerable microread builds still loaded.

Monitoring Recommendations

Alert on new kernel module loads for microread on hosts that do not require NFC.
Forward kernel ring buffer events to centralized logging and search for microread or NFC HCI stack traces.
Correlate kernel driver crashes with physical proximity events on mobile or embedded fleets that use NFC.

How to Mitigate CVE-2026-80801

Immediate Actions Required

Update to a Linux kernel version that includes the microread payload-length validation patches referenced in the kernel.org commits.
On systems that do not use NFC, blacklist the microread and related NFC modules to remove the attack surface.
Inventory embedded, mobile, and point-of-sale devices that expose NFC hardware and prioritize their patch cycles.

Patch Information

The fix is upstream in the Linux kernel via multiple stable backports. Reference commits include Kernel Commit 25519469, Kernel Commit 92a6f020, Kernel Commit 953963b9, Kernel Commit c6de4241, Kernel Commit cb298672, Kernel Commit d0902a7c, and Kernel Commit dabfa26a. Apply the vendor-provided kernel package that incorporates these changes.

Workarounds

Unload the driver at runtime with rmmod microread where NFC functionality is not required.
Add microread to /etc/modprobe.d/blacklist.conf to prevent auto-loading on boot.
Physically disable or remove NFC hardware on devices where the driver cannot be unloaded and patching is delayed.

bash

# Prevent the vulnerable driver from loading
echo 'blacklist microread' | sudo tee /etc/modprobe.d/disable-microread.conf
sudo depmod -a
sudo update-initramfs -u