CVE-2026-80799nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
- —Not scoredno CVSS score yet
- 0.23%Exploitation in 30 daysEPSS · top 86% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data advances offset past 255 it silently wraps to zero, causing infinite loops or double-processing of buffer data. 2. Before reading tlv[0] (type) and tlv[1] (length) there is no check that offset+2 <= tlv_array_len. A truncated TLV causes an OOB read of one byte past the buffer end. 3. After reading the length field, the value bytes are accessed without checking offset+2+length <= tlv_array_len. A crafted length=0xFF on a short buffer causes up to 255 bytes of OOB read past the buffer end. Both functions are reachable without authentication via nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes directly into nfc_llcp_parse_gb_tlv() with no additional validation. Fix all three issues by widening offset from u8 to u16 and adding bounds checks for both the TLV header and value field before each access.
Timeline
ID reserved
By Linux
- 9 days later
· 9 days later
Published
- 45 days later
· 45 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 0be9de2ea01e8d52646e7310a7eef5459cf07ea8 – < 2c1456fe09ab1a5a9fe1d8339ca6d509589b56e1
- affected 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0 – < 7f6f3d087c67a4346189ef2c36481455bbc59a74
- affected 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0 – < 9c47d667963542c3cf8e3007b7f10c0904d08238
- affected 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0 – < a209334ed929941b20810c17c3a507445b0a7c85
- affected 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0 – < 382eaa770335acf4f16a5a55524500f2bb4207df
- affected 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0 – < 2d239590d1845a706304833d40dd6d4fec20ad88
- affected 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0 – < e84cdfdc4a6c88e8b751144458f2e04e24415a28
- affected 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0 – < 875285a165fd3b402de2ab3be0deb355d6f4caf5
- affected 3df40eb3a2ea58bf404a38f15a7a2768e4762cb0 – < 78b20c8eeacd2e44a2d8a4cb5316d3c521d90911
- affected 1deacb5e031e289ca5636f2db4fcae6612c05d34
- affected 66a1be74230bbe098e651766c9a0cf4038db8442
- affected 5.10.188 – < 5.10.267
- affected 4.19.291 – < 4.20
- affected 5.4.251 – < 5.5
- affected 5.15
- unaffected < 5.15
- unaffected 5.10.267 – ≤ 5.10.*
- unaffected 5.15.218 – ≤ 5.15.*
- unaffected 6.1.185 – ≤ 6.1.*
- unaffected 6.6.154 – ≤ 6.6.*
- unaffected 6.12.106 – ≤ 6.12.*
- unaffected 6.18.47 – ≤ 6.18.*
- unaffected 7.1.11 – ≤ 7.1.*
- unaffected 7.2.1 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References9
- https://git.kernel.org/stable/c/2c1456fe09ab1a5a9fe1d8339ca6d509589b56e1 (opens in a new tab)
- https://git.kernel.org/stable/c/7f6f3d087c67a4346189ef2c36481455bbc59a74 (opens in a new tab)
- https://git.kernel.org/stable/c/9c47d667963542c3cf8e3007b7f10c0904d08238 (opens in a new tab)
- https://git.kernel.org/stable/c/a209334ed929941b20810c17c3a507445b0a7c85 (opens in a new tab)
- https://git.kernel.org/stable/c/382eaa770335acf4f16a5a55524500f2bb4207df (opens in a new tab)
- https://git.kernel.org/stable/c/2d239590d1845a706304833d40dd6d4fec20ad88 (opens in a new tab)
- https://git.kernel.org/stable/c/e84cdfdc4a6c88e8b751144458f2e04e24415a28 (opens in a new tab)
- https://git.kernel.org/stable/c/875285a165fd3b402de2ab3be0deb355d6f4caf5 (opens in a new tab)
- https://git.kernel.org/stable/c/78b20c8eeacd2e44a2d8a4cb5316d3c521d90911 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-71234 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-80799)Record last updated .