CVE-2026-80802: Linux Kernel NFC Buffer Overflow Vulnerability

CVE-2026-80802 Overview

CVE-2026-80802 affects the Linux kernel's Near Field Communication (NFC) subsystem, specifically the Fields Peak Driver (FDP) for I2C-connected NFC controllers. The fdp_nci_i2c_read() function accepts a device-supplied 16-bit packet length and passes it directly to i2c_master_recv() without bounds validation. A malicious, counterfeit, or malfunctioning NFC controller — or an I2C bus interposer — can drive this length far past a 261-byte on-stack buffer, producing a stack out-of-bounds write [CWE-787]. The same read loop also leaks a socket buffer (skb) when a device sends two consecutive data packets instead of the expected length/data pair.

Critical Impact
A hostile or defective NFC controller can overwrite the stack canary and return address in kernel context, enabling potential kernel code execution or denial of service on affected Linux systems.

Affected Products

Linux kernel — NFC subsystem, FDP I2C driver (drivers/nfc/fdp/i2c.c)
Distributions shipping vulnerable stable kernels prior to the fix commits
Devices with FDP-based NFC controllers connected over I2C

Discovery Timeline

2026-09-04 - CVE-2026-80802 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80802

Vulnerability Analysis

The fdp_nci_i2c_read() function in the FDP NFC driver reads two bytes from the controller that describe the length of the next NCI frame. This u16 length is used as the count argument to i2c_master_recv(), which writes into a 261-byte stack buffer sized for the maximum expected FDP payload.

Because the driver does not clamp the length to the [FDP_NCI_I2C_MIN_PAYLOAD, FDP_NCI_I2C_MAX_PAYLOAD] range, a controller returning an oversized length produces a stack out-of-bounds write. The write can overrun the buffer, corrupting the stack canary and saved return address in the caller's frame. A length below the minimum, or one that underflows via the header/LRC (Longitudinal Redundancy Check) subtraction, causes subsequent reads to run past a short receive and misinterpret buffer contents.

The same loop also allocates one skb per iteration on the assumption that a length packet is always followed by a data packet. If the device delivers two data packets consecutively, the second allocation overwrites the pointer to the first skb, leaking kernel memory each time the pattern repeats.

Root Cause

The root cause is missing input validation of an untrusted, device-supplied length field combined with a fixed-size stack destination buffer. A secondary defect is an unconditional skb allocation without freeing the prior one on the unexpected packet-pattern path.

Attack Vector

Exploitation requires the presence of a malicious or malfunctioning FDP-based NFC controller, a counterfeit replacement part, or a hardware interposer on the I2C bus. There is no remote network attack surface. The threat model is most relevant to embedded devices, kiosks, point-of-sale terminals, and mobile hardware where NFC peripherals may be physically accessible or supply-chain compromised.

No verified public exploit code is available. The vulnerability mechanism — stack buffer overflow via unvalidated hardware-supplied length — is described in the upstream commit messages linked under external references.

Detection Methods for CVE-2026-80802

Indicators of Compromise

Kernel stack protector panics (Kernel panic - not syncing: stack-protector: Kernel stack is corrupted) originating in the FDP NFC I2C read path.
Unexpected kernel oops or general protection faults referencing fdp_nci_i2c_read in the backtrace.
Growing unreclaimed slab memory in skbuff_head_cache correlated with NFC controller activity.

Detection Strategies

Enable CONFIG_STACKPROTECTOR_STRONG and CONFIG_FORTIFY_SOURCE to catch out-of-bounds writes at runtime before exploitation succeeds.
Audit loaded kernel modules for fdp_i2c on systems that do not require NFC and remove or blacklist the module where unused.
Ingest kernel logs into a centralized data lake and alert on FDP-related oops signatures, stack-protector faults, and repeated I2C transaction errors.

Monitoring Recommendations

Monitor dmesg and journald for repeated I2C read errors from FDP NFC controllers, which may indicate probing or a malfunctioning device.
Track /proc/slabinfo for anomalous growth of socket buffer caches on systems using NFC.
Correlate physical-access events with kernel fault telemetry on embedded and mobile fleets to identify hardware tampering.

How to Mitigate CVE-2026-80802

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 1fc3232, db7e464, d9498ab, 1aa3fc7, 0d72309, 7ad21dc, 8d2c243, e5eec12, and fc3c2bd.
Update to a distribution kernel that incorporates the FDP NFC fix on all affected devices.
Disable or unload the fdp_i2c kernel module on systems that do not use FDP-based NFC hardware.
Restrict physical access to devices exposing I2C buses or replaceable NFC modules.

Patch Information

The fix rejects any device-supplied length outside [FDP_NCI_I2C_MIN_PAYLOAD, FDP_NCI_I2C_MAX_PAYLOAD], treating out-of-range values as a corrupted packet and forcing resynchronization. The patch also frees any previously allocated skb before allocating the next one in the read loop, eliminating the leak. Backports are available across multiple stable kernel branches through the commits listed in the kernel.org stable tree.

Workarounds

Blacklist the fdp_i2c module in /etc/modprobe.d/ on hosts that do not require FDP NFC support.
Physically remove or disable FDP-based NFC controllers where they are not operationally required.
Enforce hardware supply-chain controls for NFC modules and I2C peripherals used in production fleets.

bash

# Blacklist the vulnerable driver on systems that do not need it
echo "blacklist fdp_i2c" | sudo tee /etc/modprobe.d/blacklist-fdp.conf
sudo rmmod fdp_i2c 2>/dev/null || true
sudo update-initramfs -u

# Verify the module is no longer loaded
lsmod | grep -i fdp