GHSA-VWX2-RH9P-3F2W
Vulnerability from github – Published: 2026-09-04 18:31 – Updated: 2026-09-04 18:31In the Linux kernel, the following vulnerability has been resolved:
nfc: st21nfca: validate ATR_REQ length against the received frame
st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at least ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req->length is at least sizeof(struct st21nfca_atr_req), but never checks that atr_req->length does not exceed the actual received length (skb->len).
st21nfca_tm_send_atr_res() then trusts the declared length:
gb_len = atr_req->length - sizeof(struct st21nfca_atr_req);
...
memcpy(atr_res->gbi, atr_req->gbi, gb_len);
so an RF peer that sends a short frame but sets atr_req->length larger than the frame makes gb_len exceed the general bytes actually present, and the memcpy reads out of bounds past the received skb. Those bytes are placed in the ATR_RES and sent back to the peer (kernel-memory disclosure to a proximity attacker); a larger declared length is an out-of-bounds read (DoS).
Reject frames whose declared length exceeds the received length. The adjacent nfc_tm_activated() path in the same function already derives its general-bytes length from skb->len rather than the declared field.
Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.
{
"affected": [],
"aliases": [
"CVE-2026-80823"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T16:18:10Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate ATR_REQ length against the received frame\n\nst21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at\nleast ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req-\u003elength\nis at least sizeof(struct st21nfca_atr_req), but never checks that\natr_req-\u003elength does not exceed the actual received length (skb-\u003elen).\n\nst21nfca_tm_send_atr_res() then trusts the declared length:\n\n\tgb_len = atr_req-\u003elength - sizeof(struct st21nfca_atr_req);\n\t...\n\tmemcpy(atr_res-\u003egbi, atr_req-\u003egbi, gb_len);\n\nso an RF peer that sends a short frame but sets atr_req-\u003elength larger\nthan the frame makes gb_len exceed the general bytes actually present,\nand the memcpy reads out of bounds past the received skb. Those bytes are\nplaced in the ATR_RES and sent back to the peer (kernel-memory disclosure\nto a proximity attacker); a larger declared length is an out-of-bounds\nread (DoS).\n\nReject frames whose declared length exceeds the received length. The\nadjacent nfc_tm_activated() path in the same function already derives its\ngeneral-bytes length from skb-\u003elen rather than the declared field.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing bound is evident from source. Compile-tested.",
"id": "GHSA-vwx2-rh9p-3f2w",
"modified": "2026-09-04T18:31:28Z",
"published": "2026-09-04T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80823"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0f344944c506b4f02d2b098489f7268b438c369e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c1ad291f4cdc357f9527b688c6fda9c6ffa7890"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/304f5b414f4051d324b8c4a3ab0e79f7dc7e150e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5cdcca5d62a66eda6b774110a44cba67bc1a8d1d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/785df00bb3ae3206674a43284eb06dac575b5c64"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9635507fe82949e429b3cd938876a9917125b151"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bfcca5f42c9aa4eadef1e5fe7bb23783d7fcc96d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dd26d30f40c43ad9cfe2f25c6ea0ead1dd51d5aa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f33cecf69095c43be88567fef92b180b858f7369"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.