CVE-2026-90223 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems with NFC capabilities, should assess their exposure to this vulnerability and apply patches or mitigations as necessary.

Why it matters

CVE-2026-90223 is a high-severity vulnerability in the Linux kernel's NFC LLCP implementation that could allow an attacker to trigger an out-of-bounds read, potentially leading to system crashes or information disclosure. Linux kernel developers and users with NFC capabilities should assess their exposure and apply patches or mitigations.

• Verify NFC LLCP implementation bounds and validation to prevent out-of-bounds reads.
• Assess exposure of Linux kernel implementations with NFC capabilities.
• Monitor for unusual NFC activity and implement additional logging and monitoring.

Technical summary

The Linux kernel's NFC LLCP implementation has a vulnerability that allows an attacker to trigger an out-of-bounds read. This occurs due to improper parsing of SNL TLVs, which can lead to underflow and buffer overrun. The vulnerability can be exploited by a nearby NFC device without authentication, as LLCP link activation happens automatically after NFC-DEP. The vulnerability was found by 0sec automated security-research tooling, and its exploitation could potentially lead to system crashes or information disclosure. To prevent exploitation, it is crucial to review and apply the provided kernel patches and verify that NFC-DEP is properly configured and secured.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to ensure the NFC LLCP implementation is properly bounded and validated.
• Verify that NFC-DEP is properly configured and secured in your Linux kernel implementation.
• Monitor for any unusual NFC activity and implement additional logging and monitoring to detect potential exploitation attempts.
• Perform a thorough review of the Linux kernel implementation to identify any potential vulnerabilities.
• Conduct regular security audits to ensure the Linux kernel is up-to-date and secure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was found by 0sec automated security-research tooling. The CVE record and NVD entry provide details on the issue, but the scope of affected systems and versions is not explicitly stated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.