CVE-2026-80799

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain

three related bugs in their TLV parsing loops:

1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data

advances offset past 255 it silently wraps to zero, causing

infinite loops or double-processing of buffer data.

2. Before reading tlv[0] (type) and tlv[1] (length) there is no

check that offset+2 <= tlv_array_len. A truncated TLV causes

an OOB read of one byte past the buffer end.

3. After reading the length field, the value bytes are accessed

without checking offset+2+length <= tlv_array_len. A crafted

length=0xFF on a short buffer causes up to 255 bytes of OOB

read past the buffer end.

Both functions are reachable without authentication via

nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes

directly into nfc_llcp_parse_gb_tlv() with no additio

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References