CVE-2026-80801 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, especially those with NFC functionality enabled, should assess exposure and prioritize patching. This includes operators managing Linux kernel deployments, vulnerability management teams, and security teams responsible for reviewing system configurations and monitoring logs for potential NFC-related anomalies.

Why it matters

This vulnerability in the Linux kernel's NFC microread component could lead to buffer over-reads if not patched. Defenders should prioritize verifying and applying patches, reviewing system configurations, and monitoring logs.

• Verify and apply patches to prevent potential buffer over-reads
• Monitor system logs for NFC-related anomalies
• Review system configurations for NFC-enabled Linux kernels

Technical summary

The `microread_target_discovered` function in the Linux kernel's NFC microread component did not validate target discovery payload lengths from `skb->data`. This could lead to buffer over-reads. The issue has been resolved by adding validation for fixed field offsets and UID copies against the actual `skb` length. Affected Linux kernel versions should be reviewed for exposure, and patches should be applied to prevent potential buffer over-reads. System configurations for NFC-enabled Linux kernels should be examined, and monitoring should be increased for NFC-related anomalies.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly in NFC-enabled systems.

Recommended defensive actions

• Verify and apply Linux kernel patches for NFC microread component
• Review system configurations for NFC-enabled Linux kernels
• Monitor system logs for potential NFC-related anomalies
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but specific affected versions and exploitation details are not provided. The Linux kernel patches are referenced, indicating resolution of the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.