CoreCVE
Back

nfc: fdp: bound the device-reported read length and fix an skb leak

Published Sep 4, 2026

Description

fdp_nci_i2c_read() takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2c_master_recv() count into a 261-byte on-stack buffer: a malicious, counterfeit or malfunctioning controller (or an i2c bus interposer) can drive it far past the buffer for a stack out-of-bounds write that clobbers the canary and return address, or below the minimum frame size (directly, or by truncating the computed sum) so the header/LRC strip and the next length read run past a short receive. Reject a length outside [FDP_NCI_I2C_MIN_PAYLOAD, FDP_NCI_I2C_MAX_PAYLOAD], as a corrupted packet already is, and force resynchronization.

The same loop allocates one data skb per iteration and assumes a length packet followed by a data packet; a device that sends two data packets in one call leaks the first skb when the second allocation overwrites it. Free a previously allocated skb before allocating the next.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published Sep 4, 2026
Updated Sep 4, 2026
Reserved Aug 26, 2026
Link CVE-2026-80802
CISA Vulnrichment
Updated n/a
NVD
Status Received
Modified Sep 4, 2026
Link CVE-2026-80802
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-80802
ENISA EUVD
Assigner n/a
Published n/a
Updated n/a
Exploited since n/a
Link n/a