CVE-2026-80803: Linux Kernel NFC Buffer Overflow Vulnerability

CVE-2026-80803 Overview

CVE-2026-80803 is a stack buffer overflow in the Linux kernel's Near Field Communication (NFC) digital protocol stack. The flaw resides in digital_in_recv_sensf_res(), which processes SENSF_RES responses from NFC-F devices. The function calls memcpy() using an attacker-controlled resp->len value without validating it against the destination buffer size of NFC_SENSF_RES_MAXSIZE. A nearby malicious NFC-F device can transmit an oversized SENSF_RES response to overflow the stack-local struct nfc_target. The vulnerability was reported by 0sec automated security-research tooling and has been resolved in the mainline Linux kernel.

Critical Impact
A proximate attacker with an NFC-F capable device can trigger a kernel stack overflow, leading to potential kernel memory corruption, denial of service, or possible code execution in kernel context.

Affected Products

Linux kernel with NFC digital protocol support enabled
Linux distributions shipping the vulnerable net/nfc/digital_technology.c implementation
Devices exposing NFC-F polling functionality prior to the fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80803 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80803

Vulnerability Analysis

The flaw is a classic stack buffer overflow ([CWE-121]) in the Linux kernel NFC subsystem. The digital_in_recv_sensf_res() function handles the response frame returned by a passive NFC-F target during polling. NFC-F is the Type-F protocol used by FeliCa and similar tags operating at 212/424 kbps.

The function copies resp->len bytes from the received response into the sensf_res field inside a stack-allocated struct nfc_target. That destination field is fixed at NFC_SENSF_RES_MAXSIZE bytes. Because resp->len originates from an attacker-supplied over-the-air frame and is not bounded, a crafted response larger than the destination triggers memory corruption on the kernel stack.

Exploitation requires physical proximity to the victim device, but no user interaction beyond an active NFC polling loop. Successful corruption can overwrite adjacent stack data, saved registers, or stack canaries, producing a kernel panic at minimum and potentially enabling code execution in ring 0.

Root Cause

The root cause is missing input validation on a length field controlled by a remote peer. The code path trusted resp->len as sanitized input and passed it directly to memcpy() without clamping against NFC_SENSF_RES_MAXSIZE. The upstream fix clamps resp->len to the destination buffer size before the copy operation.

Attack Vector

An attacker positions an NFC-F capable transmitter within radio range of a target device running a vulnerable kernel with NFC polling active. The attacker's device responds to the polling request with a SENSF_RES frame in which the length field exceeds NFC_SENSF_RES_MAXSIZE. When the kernel processes the response, the oversized memcpy() corrupts the kernel stack frame of the receiving function. No authentication and no local access are required. The vulnerability manifests during normal NFC discovery and does not require the user to actively pair or tap.

Technical details and the corrective patches are available in the upstream kernel commits, including Kernel Git Commit 31aa28e and Kernel Git Commit a56773e.

Detection Methods for CVE-2026-80803

Indicators of Compromise

Unexpected kernel oops or panic entries in dmesg referencing digital_in_recv_sensf_res or the NFC digital module
Stack protector failures logged as Kernel stack is corrupted in: digital_in_recv_sensf_res
Repeated NFC subsystem crashes on devices with NFC polling enabled while in public environments

Detection Strategies

Monitor kernel ring buffer output for stack canary violations and call traces originating in net/nfc/digital_technology.c
Audit installed kernel package versions against distribution advisories mapped to this CVE
Correlate device reboots or NFC service restarts with proximity events on mobile fleets

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized logging pipeline for kernel-crash analytics
Alert on any NFC driver module reload following an abnormal termination
Track kernel version and NFC feature exposure across managed Linux endpoints to prioritize patch rollout

How to Mitigate CVE-2026-80803

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as vendor builds are available
Inventory Linux systems with CONFIG_NFC_DIGITAL enabled and prioritize mobile, embedded, and IoT devices
Disable the NFC subsystem on systems that do not require it until patched builds are deployed

Patch Information

The fix clamps resp->len to NFC_SENSF_RES_MAXSIZE prior to the memcpy() call. Corrective patches have been merged into mainline and backported to multiple stable branches. Reference the following upstream commits: Kernel Git Commit 344a56d, Kernel Git Commit 4e942da, Kernel Git Commit 6afb297, Kernel Git Commit a1ef9bd, Kernel Git Commit af4c060, Kernel Git Commit d0756a9, and Kernel Git Commit e886c63. Consume the corresponding distribution updates rather than cherry-picking manually where possible.

Workarounds

Unload the nfc_digital and nfc kernel modules on systems where NFC is not required
Blacklist NFC modules via /etc/modprobe.d/ to prevent automatic reload after reboot
Physically disable or remove NFC hardware on affected embedded devices where module removal is not feasible

bash

# Disable the NFC digital stack until patches are deployed
sudo modprobe -r nfc_digital nfc
echo 'blacklist nfc_digital' | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo 'blacklist nfc'         | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
sudo update-initramfs -u