CVE-2026-80796

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: add data_len bound checks to activation parameter extractors

nci_extract_activation_params_iso_dep() and

nci_extract_activation_params_nfc_dep() read an inner length byte from

the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed

kernel buffers, but neither function receives the caller-validated

activation_params_len. A crafted NCI notification with

activation_params_len=1 and an inner length byte of up to 20 (NFC-A) or

50 (NFC-B) causes memcpy() to read that many bytes past the one valid

byte in the activation params region -- a slab out-of-bounds read of

kernel memory adjacent to the NCI skb.

The sibling nci_extract_rf_params_*() family was given equivalent

protection by commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter

validation for packet data"), but the two activation parameter

extractors were not updated at that time.

Add a data_len parameter to both functions, guard against an

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References