CVE-2026-80799 (GCVE-0-2026-80799)
Vulnerability from cvelistv5
Published
2026-09-04 15:13
Modified
2026-10-19 08:43
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data advances offset past 255 it silently wraps to zero, causing infinite loops or double-processing of buffer data. 2. Before reading tlv[0] (type) and tlv[1] (length) there is no check that offset+2 <= tlv_array_len. A truncated TLV causes an OOB read of one byte past the buffer end. 3. After reading the length field, the value bytes are accessed without checking offset+2+length <= tlv_array_len. A crafted length=0xFF on a short buffer causes up to 255 bytes of OOB read past the buffer end. Both functions are reachable without authentication via nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes directly into nfc_llcp_parse_gb_tlv() with no additional validation. Fix all three issues by widening offset from u8 to u16 and adding bounds checks for both the TLV header and value field before each access.
References
Impacted products
Vendor Product Version
Linux Linux Version: 0be9de2ea01e8d52646e7310a7eef5459cf07ea8
Version: 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Version: 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Version: 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Version: 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Version: 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Version: 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Version: 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Version: 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Version: 1deacb5e031e289ca5636f2db4fcae6612c05d34
Version: 66a1be74230bbe098e651766c9a0cf4038db8442
Version: 5.10.188   ≤
Version: 4.19.291   ≤
Version: 5.4.251   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/llcp_commands.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2c1456fe09ab1a5a9fe1d8339ca6d509589b56e1",
              "status": "affected",
              "version": "0be9de2ea01e8d52646e7310a7eef5459cf07ea8",
              "versionType": "git"
            },
            {
              "lessThan": "7f6f3d087c67a4346189ef2c36481455bbc59a74",
              "status": "affected",
              "version": "3df40eb3a2ea58bf404a38f15a7a2768e4762cb0",
              "versionType": "git"
            },
            {
              "lessThan": "9c47d667963542c3cf8e3007b7f10c0904d08238",
              "status": "affected",
              "version": "3df40eb3a2ea58bf404a38f15a7a2768e4762cb0",
              "versionType": "git"
            },
            {
              "lessThan": "a209334ed929941b20810c17c3a507445b0a7c85",
              "status": "affected",
              "version": "3df40eb3a2ea58bf404a38f15a7a2768e4762cb0",
              "versionType": "git"
            },
            {
              "lessThan": "382eaa770335acf4f16a5a55524500f2bb4207df",
              "status": "affected",
              "version": "3df40eb3a2ea58bf404a38f15a7a2768e4762cb0",
              "versionType": "git"
            },
            {
              "lessThan": "2d239590d1845a706304833d40dd6d4fec20ad88",
              "status": "affected",
              "version": "3df40eb3a2ea58bf404a38f15a7a2768e4762cb0",
              "versionType": "git"
            },
            {
              "lessThan": "e84cdfdc4a6c88e8b751144458f2e04e24415a28",
              "status": "affected",
              "version": "3df40eb3a2ea58bf404a38f15a7a2768e4762cb0",
              "versionType": "git"
            },
            {
              "lessThan": "875285a165fd3b402de2ab3be0deb355d6f4caf5",
              "status": "affected",
              "version": "3df40eb3a2ea58bf404a38f15a7a2768e4762cb0",
              "versionType": "git"
            },
            {
              "lessThan": "78b20c8eeacd2e44a2d8a4cb5316d3c521d90911",
              "status": "affected",
              "version": "3df40eb3a2ea58bf404a38f15a7a2768e4762cb0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1deacb5e031e289ca5636f2db4fcae6612c05d34",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "66a1be74230bbe098e651766c9a0cf4038db8442",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.267",
              "status": "affected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.291",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.251",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/llcp_commands.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "5.10.188",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.291",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.251",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix OOB read and u8 offset wrap in TLV parsers\n\nnfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain\nthree related bugs in their TLV parsing loops:\n\n1. \u0027offset\u0027 is declared u8 but tlv_array_len is u16. When TLV data\n   advances offset past 255 it silently wraps to zero, causing\n   infinite loops or double-processing of buffer data.\n\n2. Before reading tlv[0] (type) and tlv[1] (length) there is no\n   check that offset+2 \u003c= tlv_array_len. A truncated TLV causes\n   an OOB read of one byte past the buffer end.\n\n3. After reading the length field, the value bytes are accessed\n   without checking offset+2+length \u003c= tlv_array_len. A crafted\n   length=0xFF on a short buffer causes up to 255 bytes of OOB\n   read past the buffer end.\n\nBoth functions are reachable without authentication via\nnfc_llcp_set_remote_gb() which feeds remote LLCP general bytes\ndirectly into nfc_llcp_parse_gb_tlv() with no additional\nvalidation.\n\nFix all three issues by widening offset from u8 to u16 and adding\nbounds checks for both the TLV header and value field before each\naccess."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:43:52.451Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2c1456fe09ab1a5a9fe1d8339ca6d509589b56e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f6f3d087c67a4346189ef2c36481455bbc59a74"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c47d667963542c3cf8e3007b7f10c0904d08238"
        },
        {
          "url": "https://git.kernel.org/stable/c/a209334ed929941b20810c17c3a507445b0a7c85"
        },
        {
          "url": "https://git.kernel.org/stable/c/382eaa770335acf4f16a5a55524500f2bb4207df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d239590d1845a706304833d40dd6d4fec20ad88"
        },
        {
          "url": "https://git.kernel.org/stable/c/e84cdfdc4a6c88e8b751144458f2e04e24415a28"
        },
        {
          "url": "https://git.kernel.org/stable/c/875285a165fd3b402de2ab3be0deb355d6f4caf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/78b20c8eeacd2e44a2d8a4cb5316d3c521d90911"
        }
      ],
      "title": "nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80799",
    "datePublished": "2026-09-04T15:13:13.311Z",
    "dateReserved": "2026-08-26T14:34:25.793Z",
    "dateUpdated": "2026-10-19T08:43:52.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.