CVE-2026-80823: Linux Kernel NFC Information Disclosure Flaw

CVE-2026-80823 Overview

CVE-2026-80823 is an out-of-bounds read vulnerability in the Linux kernel's nfc/st21nfca driver. The flaw resides in st21nfca_tm_recv_atr_req(), which fails to validate that the self-declared atr_req->length field does not exceed the actual received frame length (skb->len). A Near Field Communication (NFC) peer within RF range can craft a short ATR_REQ frame with an oversized declared length. The subsequent st21nfca_tm_send_atr_res() trusts the declared value and performs a memcpy that reads past the socket buffer boundary. The out-of-bounds bytes are copied into the ATR_RES response and transmitted back to the attacker.

Critical Impact
A proximity attacker within NFC range can trigger kernel memory disclosure or denial of service against affected Linux systems using the st21nfca NFC driver.

Affected Products

Linux kernel — drivers/nfc/st21nfca subsystem
Systems using STMicroelectronics ST21NFCA NFC controllers with the affected driver
Multiple stable kernel branches (see patch commits below)

Discovery Timeline

2026-09-04 - CVE-2026-80823 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80823

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the NFC target-mode ATR_REQ handling path. The function st21nfca_tm_recv_atr_req() performs two length checks: it verifies the received frame is at least ST21NFCA_ATR_REQ_MIN_SIZE bytes, and it verifies that the self-declared atr_req->length field is at least sizeof(struct st21nfca_atr_req). It never verifies that atr_req->length is bounded by skb->len.

Downstream, st21nfca_tm_send_atr_res() computes the general-bytes length directly from the attacker-controlled declared field: gb_len = atr_req->length - sizeof(struct st21nfca_atr_req). The subsequent memcpy(atr_res->gbi, atr_req->gbi, gb_len) reads beyond the received socket buffer. Those bytes are then placed into the ATR_RES response and transmitted back over RF to the peer.

Root Cause

The root cause is missing input validation on an attacker-controlled length field in a protocol header. The kernel treats the declared length as authoritative without cross-checking it against the actual size of the received frame. The adjacent nfc_tm_activated() code path in the same function already derives its general-bytes length from skb->len, making the missing check evident.

Attack Vector

Exploitation requires an attacker to be within NFC radio range of a target device with the vulnerable driver bound to active hardware. The attacker sends a malformed ATR_REQ frame that is shorter than the value declared in its length field. A small oversize yields kernel-memory disclosure back to the attacker via the ATR_RES response. A larger declared length triggers an out-of-bounds read that can cause a denial of service. No authentication or user interaction on the target is required.

No public proof-of-concept exploit is currently listed for this issue, and it is not tracked in the CISA Known Exploited Vulnerabilities catalog. See the upstream fixes referenced under Patch Information for the corrective code.

Detection Methods for CVE-2026-80823

Indicators of Compromise

Unexpected ATR_RES frames emitted by an NFC-enabled Linux host in target mode containing non-protocol byte patterns
Kernel log entries or crashes originating in the st21nfca driver following NFC peer interaction
Presence of a running kernel version predating the fix commits on hosts with ST21NFCA NFC hardware

Detection Strategies

Inventory Linux endpoints for the st21nfca and st21nfca_hci modules using lsmod and correlate with running kernel version
Compare installed kernel package versions against the fixed stable releases referenced in the kernel.org commits
Monitor dmesg and syslog for NFC subsystem faults, KASAN reports, or general protection faults referencing st21nfca_tm_send_atr_res

Monitoring Recommendations

Enable kernel address sanitizer (KASAN) in test environments to surface out-of-bounds reads in the NFC stack
Forward kernel logs to a centralized log platform and alert on NFC driver crashes or unloads
Track patch compliance for Linux endpoints that ship with NFC hardware, particularly embedded and mobile-class devices

How to Mitigate CVE-2026-80823

Immediate Actions Required

Update to a Linux kernel version containing the ATR_REQ length validation fix from your distribution's stable channel
On systems that do not require NFC functionality, blacklist the st21nfca and st21nfca_hci modules to remove the attack surface
Physically disable or remove NFC controllers on devices where the interface is not operationally required

Patch Information

The fix rejects ATR_REQ frames whose self-declared atr_req->length exceeds the actual received skb->len. Patches have been backported across multiple stable branches. Reference commits include 0f344944c506, 2c1ad291f4cd, 304f5b414f40, 5cdcca5d62a6, 785df00bb3ae, 9635507fe829, bfcca5f42c9a, dd26d30f40c4, and f33cecf69095.

Workarounds

Unload the vulnerable driver at runtime with modprobe -r st21nfca_hci st21nfca where NFC is unused
Add blacklist st21nfca and blacklist st21nfca_hci entries under /etc/modprobe.d/ to prevent auto-loading
Restrict physical access to affected devices to reduce RF proximity exposure until patches are deployed

bash

# Prevent the vulnerable NFC driver from loading
echo 'blacklist st21nfca' | sudo tee /etc/modprobe.d/disable-st21nfca.conf
echo 'blacklist st21nfca_hci' | sudo tee -a /etc/modprobe.d/disable-st21nfca.conf
sudo modprobe -r st21nfca_hci st21nfca
sudo update-initramfs -u