CVE-2026-80823 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems with NFC capabilities should assess exposure and apply patches or updates as necessary. Linux kernel developers should verify patch application and test NFC subsystem configurations. Security teams and vulnerability management teams should review and prioritize patching based on asset inventory and risk assessment.

Why it matters

This vulnerability in the Linux kernel's NFC subsystem can lead to kernel memory disclosure or denial of service. Linux kernel developers, maintainers, and users of Linux-based systems with NFC capabilities should assess exposure and apply patches or updates as necessary.

• Kernel memory disclosure to proximity attackers
• Denial of service (DoS) via out-of-bounds read

Technical summary

The st21nfca_tm_recv_atr_req function in the Linux kernel's NFC subsystem did not properly validate the length of the received ATR_REQ frame, leading to a potential buffer over-read. An attacker could exploit this by sending a specially crafted frame, potentially causing a kernel memory disclosure or denial of service. The fix involves adding bounds checking to prevent out-of-bounds reads. Linux kernel developers and maintainers should assess exposure and apply patches or updates as necessary to prevent potential kernel memory disclosure or denial of service.

Defensive priority

Medium

Recommended defensive actions

• Review and apply patches for the st21nfca driver
• Update Linux kernel to the latest version
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was found by 0sec using automated source analysis. The issue is caused by the lack of bounds checking on the atr_req->length field, which can lead to an out-of-bounds read. The fix involves rejecting frames whose declared length exceeds the received length. Linux kernel developers should verify patch application and test NFC subsystem configurations. Evidence limits suggest that NFC subsystem testing may be limited or constrained.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.