CVE-2026-80795 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems that use the NFC subsystem, should assess their exposure to this vulnerability and apply the provided patches to fix the issue.

Why it matters

The CVE-2026-80795 vulnerability in the Linux kernel's NFC subsystem can lead to an out-of-bounds write, potentially causing denial of service or elevation of privileges. Linux kernel developers and maintainers should assess their exposure and apply patches to fix the issue.

• Potential for denial of service (DoS) due to out-of-bounds write
• Possible elevation of privileges for attackers
• Need for verification of affected Linux kernel versions
• Remediation priority for Linux kernel developers and maintainers

Technical summary

The `nci_target_auto_activated()` function in the Linux kernel's NFC subsystem does not check if the `ndev->targets` array is full before appending a new target. This can lead to an out-of-bounds write when the array is full, causing a slab out-of-bounds write vulnerability. The vulnerability can be triggered by an NFCC (NFC Controller) that repeatedly re-runs discovery and reports an auto-activated target. Linux kernel developers and maintainers should assess their exposure and apply patches to fix the issue. The fix involves adding a bounds check to prevent the out-of-bounds write. Affected product deployments should be reviewed and updated to prevent exploitation.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to fix the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor NFC-related logs for potential exploitation attempts
• Verify the NFC subsystem configuration to prevent exploitation
• Conduct a thorough review of the system's exposure to this vulnerability
• Implement compensating controls to mitigate potential impacts
• Track changes to the Linux kernel and NFC subsystem for future updates

Evidence notes

The vulnerability is caused by a missing bounds check in the `nci_target_auto_activated()` function, which allows an attacker to write past the end of the `ndev->targets` array. The issue can be triggered by an NFCC that repeatedly re-runs discovery and reports an auto-activated target.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.