CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing

🗓️ 19 Jul 2026 14:55:19Reported by LinuxType

Fix out-of-bounds read in the NFC host controller interface header protocol parsing by adding safety checks before header access.

Reporter	Title	Published	Views	Family All 22
CVE	CVE-2026-63915	19 Jul 202614:55	–	cve
Debian CVE	CVE-2026-63915	19 Jul 202614:55	–	debiancve
EUVD	EUVD-2026-45688	19 Jul 202614:55	–	euvd
NVD	CVE-2026-63915	19 Jul 202616:17	–	nvd
OSV	BELL-CVE-2026-63915	22 Jul 202606:05	–	osv
OSV	DEBIAN-CVE-2026-63915	19 Jul 202616:17	–	osv
OSV	ROOT-OS-UBUNTU-2204-CVE-2026-63915 CVE-2026-63915 in linux - Patched by Root	6 Aug 202607:51	–	osv
OSV	UBUNTU-CVE-2026-63915	20 Jul 202600:00	–	osv
OSV	USN-8593-1 linux-ibm, linux-oracle vulnerabilities	23 Jul 202607:35	–	osv
OSV	USN-8603-1 linux-azure, linux-azure-fde vulnerabilities	24 Jul 202609:51	–	osv

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/nfc/hci/core.c",
      "net/nfc/nci/hci.c"
    ],
    "versions": [
      {
        "version": "8b8d2e08bf0d50193931afd27482a59376b66b2b",
        "lessThan": "ed6d5d97dad0334a7f43d218753429cbe2f70a4f",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b8d2e08bf0d50193931afd27482a59376b66b2b",
        "lessThan": "b99366d74b535d0cadb1ef73e04639415d9ff3b7",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b8d2e08bf0d50193931afd27482a59376b66b2b",
        "lessThan": "37382293f174b82a0616c8295e32b1fc8e13d1ed",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b8d2e08bf0d50193931afd27482a59376b66b2b",
        "lessThan": "c4cc6b3b0013acb3ed0b2b60e57dfae98647fe98",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b8d2e08bf0d50193931afd27482a59376b66b2b",
        "lessThan": "1905f5ec3641b2b234bb63549c8ca11ab85466eb",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b8d2e08bf0d50193931afd27482a59376b66b2b",
        "lessThan": "22d41b176b9989efd21c3b2d3abf6728f05b9d9a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b8d2e08bf0d50193931afd27482a59376b66b2b",
        "lessThan": "83b1362edc9d6ae376c6f36da116e2c70f2e70a6",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b8d2e08bf0d50193931afd27482a59376b66b2b",
        "lessThan": "f040e590c035bfd9553fe79ee9585caf1b14d67b",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/nfc/hci/core.c",
      "net/nfc/nci/hci.c"
    ],
    "versions": [
      {
        "version": "3.5",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "3.5",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.259",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.210",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.176",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.143",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.93",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.35",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.12",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/37382293f174b82a0616c8295e32b1fc8e13d1ed
git	www.git.kernel.org/stable/c/83b1362edc9d6ae376c6f36da116e2c70f2e70a6
git	www.git.kernel.org/stable/c/b99366d74b535d0cadb1ef73e04639415d9ff3b7
git	www.git.kernel.org/stable/c/22d41b176b9989efd21c3b2d3abf6728f05b9d9a
git	www.git.kernel.org/stable/c/f040e590c035bfd9553fe79ee9585caf1b14d67b
git	www.git.kernel.org/stable/c/c4cc6b3b0013acb3ed0b2b60e57dfae98647fe98
git	www.git.kernel.org/stable/c/1905f5ec3641b2b234bb63549c8ca11ab85466eb
git	www.git.kernel.org/stable/c/ed6d5d97dad0334a7f43d218753429cbe2f70a4f

05 Aug 2026 12:37Current

CVSS 3.18.8

EPSS0.00345