CVE-2026-80823

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate ATR_REQ length against the received frame

st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at

least ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req->length

is at least sizeof(struct st21nfca_atr_req), but never checks that

atr_req->length does not exceed the actual received length (skb->len).

st21nfca_tm_send_atr_res() then trusts the declared length:

gb_len = atr_req->length - sizeof(struct st21nfca_atr_req);

...

memcpy(atr_res->gbi, atr_req->gbi, gb_len);

so an RF peer that sends a short frame but sets atr_req->length larger

than the frame makes gb_len exceed the general bytes actually present,

and the memcpy reads out of bounds past the received skb. Those bytes are

placed in the ATR_RES and sent back to the peer (kernel-memory disclosure

to a proximity attacker); a larger declared length is an out-of-bounds

read (DoS).

Reject frames whose declared le

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References