CVE-2026-80794 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using NFC functionality, should assess their exposure and prioritize patching to prevent potential information exposure.

Why it matters

CVE-2026-80794 is a vulnerability in the Linux kernel's NFC subsystem that could lead to information exposure due to uninitialized variables. Defenders should prioritize patching and monitoring to prevent potential exploitation.

• Potential exposure of sensitive information
• Verification of patch application required
• Monitoring system logs for exploitation attempts necessary

Technical summary

The vulnerability is caused by uninitialized variables in the RF discover and activated NTF handlers of the Linux kernel's NFC subsystem. This could lead to exposure of sensitive information when processing certain NFC notifications. The issue arises from the use of uninitialized variables in the nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() functions, which parse notifications into on-stack structs that are not initialized. The RF technology-specific parameters are only extracted when rf_tech_specific_params_len is non-zero, leaving the rf_tech_specific_params union uninitialized when no technology-specific parameters are present.

Defensive priority

Defenders should prioritize verifying and applying the patch to the Linux kernel's NFC subsystem to prevent potential information exposure.

Recommended defensive actions

• Verify and apply the patch to the Linux kernel's NFC subsystem
• Review and update NFC-related configurations and settings
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was discovered in the Linux kernel's NFC subsystem, specifically in the RF discover and activated NTF handlers. The issue arises from uninitialized variables, which could lead to exposure of sensitive information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.