Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-90223

nfc: llcp: bound SNL TLV parsing to the skb and add length checks

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfc_llcp_recv_snl() walked the SNL TLV list using a u16 offset/length pair derived from skb->len, without bounding reads to the actual skb data. Three problems followed: • For a short frame (skb->len < LLCP_HEADER_SIZE), tlv_len underflowed. • The per-TLV header (type, length) was read without checking that two bytes remained. • A declared TLV length could run past the end of the buffer, and an SDREQ with length == 0 made "service_name_len = length - 1" underflow (size_t), driving an out-of-bounds read in the following strncmp() / nfc_llcp_sock_from_sn(). The SDRES case likewise read tlv[2]/tlv[3] without a length check. A nearby NFC device can reach this without authentication; LLCP link activation happens automatically after NFC-DEP. Walk the TLV list by pointer, bounded by skb_tail_pointer() over the linear skb data, and validate each TLV declared length before use. Add explicit length checks for SDREQ (>= 1) and SDRES (exactly 2). Found by 0sec automated security-research tooling (https://0sec.ai).

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 19cfe5843e86cc95542d9d875c9386e197956d75 · fixed in 88b36d36e12c9ba76decdb580d9c1907c084e587; From 19cfe5843e86cc95542d9d875c9386e197956d75 · fixed in 587fc2a5a35b41883b22b8f808fe5d345208914b; From 19cfe5843e86cc95542d9d875c9386e197956d75 · fixed in f04ac9bf2379f3e2470c400c235eb12f74891bef; From 19cfe5843e86cc95542d9d875c9386e197956d75 · fixed in 02030f95820c42431280f4f945ff34247fb840ff; From 19cfe5843e86cc95542d9d875c9386e197956d75 · fixed in 99fdb5c2522f365efa199d0117b641e35097041e; From 19cfe5843e86cc95542d9d875c9386e197956d75 · fixed in 749a9048bf51a668ec3ab6c0392ba32325607281; From 19cfe5843e86cc95542d9d875c9386e197956d75 · fixed in eeb16fb24cfe67947b832fd9ada5f488afc72579; From 19cfe5843e86cc95542d9d875c9386e197956d75 · fixed in f4c7f37f0ab990952539dc68d931d65c3657600a

  • Linux Linux

    3.8

  • KernelLinux

    From 3.8.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 8

git.kernel.org