CVE-2026-80802

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: fdp: bound the device-reported read length and fix an skb leak

fdp_nci_i2c_read() takes the next packet length from two device-supplied

bytes and never validates it. The value is a u16 used as the

i2c_master_recv() count into a 261-byte on-stack buffer: a malicious,

counterfeit or malfunctioning controller (or an i2c bus interposer) can

drive it far past the buffer for a stack out-of-bounds write that

clobbers the canary and return address, or below the minimum frame size

(directly, or by truncating the computed sum) so the header/LRC strip

and the next length read run past a short receive. Reject a length

outside [FDP_NCI_I2C_MIN_PAYLOAD, FDP_NCI_I2C_MAX_PAYLOAD], as a

corrupted packet already is, and force resynchronization.

The same loop allocates one data skb per iteration and assumes a length

packet followed by a data packet; a device that sends two data packets

in one call leaks the first skb when the sec

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References