{"id":"CVE-2026-80800","revision":"19d81354a5a84357b65051a2169a576f","records":[{"revision":"19d81354a5a84357b65051a2169a576f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80800","aliases":[],"title":"nfc: llcp: bound the connect_sn TLV walk to the skb","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: bound the connect_sn TLV walk to the skb\n\nCommit 27256cdb290e (\"nfc: llcp: bound SNL TLV parsing to the skb and\nadd length checks\") fixed the unbounded TLV walk in nfc_llcp_recv_snl(),\nand commit d8bd2dedbde5 (\"nfc: llcp: fix OOB read and u8 offset wrap in\nTLV parsers\") subsequently bounded nfc_llcp_parse_gb_tlv() and\nnfc_llcp_parse_connection_tlv(). One sibling parser sharing the same\npattern remains unbounded: nfc_llcp_connect_sn().\n\nnfc_llcp_connect_sn() walks a TLV list, reading a two-byte header\n(type, length) followed by length bytes of value, without checking that\nthe two header bytes or the declared length stay within the buffer. It\nreturns a pointer to a service name of up to 255 bytes that may point\npast the end of the skb; it is subsequently consumed by memcmp() in\nnfc_llcp_sock_from_sn(). In addition tlv_array_len was computed as\n\"skb->len - LLCP_HEADER_SIZE\" in size_t, so a CONNECT/CC frame shorter\nthan the LLCP header underflows to a huge length and the walk runs far\npast the buffer.\n\nnfc_llcp_connect_sn() is reachable from nfc_llcp_recv_connect() and\nnfc_llcp_recv_cc(), i.e. from received CONNECT and CC PDUs. A nearby\nNFC device can reach this without authentication; LLCP link activation\nhappens automatically after NFC-DEP, and the nfc_llcp_rx_skb()\ndispatcher applies no minimum-length guard.\n\nWalk the TLV list by pointer, bounded by skb_tail_pointer(skb), and\nvalidate each declared length before use, matching the approach already\nused for nfc_llcp_recv_snl(). Starting the walk at\n&skb->data[LLCP_HEADER_SIZE] against the tail pointer also removes the\nsize_t underflow for short frames.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).","state":0,"publishedAt":"2026-09-04T15:13:14.271+00:00","modifiedAt":"2026-10-19T08:43:53.425+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/nfc/llcp_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"b2ebdfe3d5b76e91f267a61cbc3f9a0e3f77071e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"e18d044bab6d3d0280639098c3fe6621692cbfe2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"65a0ec7783b06068dda6745dd689bf4a91ee64aa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"1964addc8dd535a05d5d3b55b4d1ac19ae31aa65\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"389986fd79e4d43f971a03b512645a1bb63c982f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"e87527b506c40db9af528714b7b1240918eb80fc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"22e5177ba1196a0b272a6a46c2575eb940a939c4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"0cfbdb0e13ab5b0765d77f96af67eb879cbc9736\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d646960f7986fefb460a2b062d5ccc8ccfeacc3a\",\n                            \"lessThan\": \"55c68ac93e7dacc0f5f608b9c39dd4ff48cf28e8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/nfc/llcp_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.267\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.218\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.185\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.154\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.106\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.47\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.11\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.1\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/b2ebdfe3d5b76e91f267a61cbc3f9a0e3f77071e","https://git.kernel.org/stable/c/e18d044bab6d3d0280639098c3fe6621692cbfe2","https://git.kernel.org/stable/c/65a0ec7783b06068dda6745dd689bf4a91ee64aa","https://git.kernel.org/stable/c/1964addc8dd535a05d5d3b55b4d1ac19ae31aa65","https://git.kernel.org/stable/c/389986fd79e4d43f971a03b512645a1bb63c982f","https://git.kernel.org/stable/c/e87527b506c40db9af528714b7b1240918eb80fc","https://git.kernel.org/stable/c/22e5177ba1196a0b272a6a46c2575eb940a939c4","https://git.kernel.org/stable/c/0cfbdb0e13ab5b0765d77f96af67eb879cbc9736","https://git.kernel.org/stable/c/55c68ac93e7dacc0f5f608b9c39dd4ff48cf28e8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80800","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80800","identifiers":["CVE-2026-80800"]},"retained":false,"historicalAffected":[]}],"coverage":[]}