CVE-2026-63915 Linux CVE debrief

Who should care

Users of the Linux kernel, particularly those using NFC functionality, should be aware of this vulnerability and take steps to ensure their systems are updated with the latest kernel patches. This includes administrators of Linux-based systems, developers of NFC-enabled applications, and security teams responsible for monitoring and mitigating vulnerabilities.

Technical summary

The vulnerability exists in the Linux kernel's NFC HCI implementation. Specifically, the nfc_hci_recv_from_llc() and nci_hci_data_received_cb() functions do not properly check the length of the HCP header before accessing it, allowing for an out-of-bounds read. This can be exploited by a malicious NFC peer sending a specially crafted 0-byte HCP frame. The issue was fixed by adding a pskb_may_pull() check at the entry of each function before packet->header is first accessed. This fix ensures that the buffer holds at least one byte before accessing packet->header, preventing the out-of-bounds read.

Defensive priority

High

Recommended defensive actions

• Apply kernel patches to update the Linux kernel to a version that includes the fix
• Use secure NFC peer authentication and authorization mechanisms
• Monitor NFC traffic for suspicious activity
• Review system logs for signs of exploitation
• Implement compensating controls for exposed systems
• Conduct regular vulnerability assessments and penetration testing
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-07-19T16:17:09.517Z and has not been modified since then. The NVD entry is currently Received. There is no additional information available about the vulnerability beyond what is provided in the CVE record and NVD entry. Users should verify the affected scope and severity with the official advisory or CVE record. Defensive verification tasks include reviewing system logs for suspicious NFC activity and ensuring that the latest kernel patches are applied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.