EUVD-2026-81819

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

CVE-2026-90226

CVE-2026-90226 affects the Linux kernel NFC LLCP subsystem . In nfc_llcp_getsockopt(), the kernel unconditionally stores 4 bytes via put_user() regardless of the caller-supplied optlen, because the existing min_t(u32, len, sizeof(u32)) only clamps the reported length but not the actual write. A c...

CVE-2026-80799 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...