nfc: microread: validate target discovery payload lengths

Summary

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate. The fixed field offsets and UID copies were checked only against the destination nfc_target buffers, not against the actual skb length. Validate that each gate-specific payload contains the fixed fields and UID bytes before reading or copying them.

Timeline

1. Sep 4, 2026, 3:13 PM UTCCVE published
2. Oct 19, 2026, 8:43 AM UTCRecord last updated

Affected versions

• Linux Linux

  From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in c6de4241f2efbbab286efbb84a9c7190298b3052; From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in 92a6f0201bb68391b5eba1b3f330af007d7323b6; From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in cb298672282421159e53ab311fe49d204c8a52da; From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in 18f02354ed229b8e4561b580812d026e7eb29c85; From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in e6397fe7b8b5ef18e051f49612d40ff476c5f7d9; From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in d0902a7c454326c6384c614226ab8987f3fd425d; From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in dabfa26a208e56f4d8dbf26fddc48f188bdb0649; From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in 953963b9ac5eecbb316617d337bfaa3d731e3c5e; From cfad1ba87150e198be9ea32367a24e500e59de2c · fixed in 25519469972ef57c3edb1805dabd6c5612b90211

• Linux Linux

  3.9

• KernelLinux

  From 3.9.0 · fixed in 5.10.267; From 5.11.0 · fixed in 5.15.218; From 5.16.0 · fixed in 6.1.185; From 6.2.0 · fixed in 6.6.154; From 6.7.0 · fixed in 6.12.106; From 6.13.0 · fixed in 6.18.47; From 6.19.0 · fixed in 7.1.11; From 7.2.0 · fixed in 7.2.1

References 9