CVE-2026-80823 nfc: st21nfca: validate ATR_REQ length against the received frame

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATRREQ length against the received frame st21nfcatmrecvatrreq checks that the received ATRREQ frame is at least ST21NFCAATRREQMINSIZE and that the self-declared atrreq-length is at least sizeofstruct...

EUVD-2026-71265

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATRREQ length against the received frame st21nfcatmrecvatrreq checks that the received ATRREQ frame is at least ST21NFCAATRREQMINSIZE and that the self-declared atrreq-length is at least sizeofstruct...

CVE-2026-80823

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATRREQ length against the received frame st21nfcatmrecvatrreq checks that the received ATRREQ frame is at least ST21NFCAATRREQMINSIZE and that the self-declared atrreq-length is at least sizeofstruct...

CVE-2026-80803 nfc: digital: clamp SENSF_RES length to the destination buffer

In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSFRES length to the destination buffer digitalinrecvsensfres memcpys resp-len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A...

CVE-2026-80803 nfc: digital: clamp SENSF_RES length to the destination buffer

In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSFRES length to the destination buffer digitalinrecvsensfres memcpys resp-len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A...

EUVD-2026-71238

In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSFRES length to the destination buffer digitalinrecvsensfres memcpys resp-len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A...

CVE-2026-80803

In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSFRES length to the destination buffer digitalinrecvsensfres memcpys resp-len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A...

CVE-2026-80803

CVE-2026-80803 affects the Linux kernel NFC digital driver. The function digital_in_recv_sensf_res() copies resp->len bytes from a remote NFC-F device response into a fixed-size NFC_SENSF_RES_MAXSIZE buffer without an upper-bound check. A nearby malicious NFC-F device can send an oversized SEN...

CVE-2026-80802

CVE-2026-80802 affects the Linux kernel's NFC FDP driver (nfc: fdp). The function fdp_nci_i2c_read() uses a u16 value from two device-supplied bytes as the count for i2c_master_recv() into a 261-byte on-stack buffer without validation. A malicious, counterfeit, or malfunctioning NFC controller (o...

CVE-2026-80802

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2cmasterrecv count into a...

CVE-2026-80802 nfc: fdp: bound the device-reported read length and fix an skb leak

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2cmasterrecv count into a...

EUVD-2026-71237

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2cmasterrecv count into a...

CVE-2026-80802 nfc: fdp: bound the device-reported read length and fix an skb leak

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2cmasterrecv count into a...

EUVD-2026-71236

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-80801

CVE-2026-80801 affects the Linux kernel's NFC microread driver. The function microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate, but fixed field offsets and UID copies were validated only against the destination nfc_target buffers rather tha...

CVE-2026-80801 nfc: microread: validate target discovery payload lengths

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-80801

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-80801 nfc: microread: validate target discovery payload lengths

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-80800

CVE-2026-80800 affects the Linux kernel NFC LLCP subsystem. The function nfc_llcp_connect_sn() walks a TLV list without validating that the two-byte header or declared length stay within the skb buffer, and computes tlv_array_len as skb->len - LLCP_HEADER_SIZE in size_t, causing an underflow f...

EUVD-2026-71235

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...