CVE-2026-90370: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

CVE-2026-80800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

CVE-2026-80798

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCPHEADERSIZE bytes before parsing it. nfcllcprxskb...

EUVD-2026-71235

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

CVE-2026-80800

CVE-2026-80800 affects the Linux kernel NFC LLCP subsystem. The function nfc_llcp_connect_sn() walks a TLV list without validating that the two-byte header or declared length stay within the skb buffer, and computes tlv_array_len as skb->len - LLCP_HEADER_SIZE in size_t, causing an underflow f...

CVE-2026-80800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

EUVD-2026-71441

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCPHEADERSIZE bytes before parsing it. nfcllcprxskb...

PT-2026-85639

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCP HEADER SIZE bytes before parsing it. nfc llcp rx...

CVE-2026-80800: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...