Riskcovery

CVE-2026-80801

nfc: microread: validate target discovery payload lengths

State
Published
Severity
Not scored
Published
Sep 4, 2026
Updated
Oct 19, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: microread: validate target discovery payload lengths

microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate. The fixed field offsets and UID copies were checked only against the destination nfc_target buffers, not against the actual skb length.

Validate that each gate-specific payload contains the fixed fields and UID bytes before reading or copying them.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before c6de4241f2efbbab286efbb84a9c7190298b3052Affected
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before 92a6f0201bb68391b5eba1b3f330af007d7323b6Affected
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before cb298672282421159e53ab311fe49d204c8a52daAffected
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before 18f02354ed229b8e4561b580812d026e7eb29c85Affected
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before e6397fe7b8b5ef18e051f49612d40ff476c5f7d9Affected
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before d0902a7c454326c6384c614226ab8987f3fd425dAffected
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before dabfa26a208e56f4d8dbf26fddc48f188bdb0649Affected
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before 953963b9ac5eecbb316617d337bfaa3d731e3c5eAffected
  • cfad1ba87150e198be9ea32367a24e500e59de2c to before 25519469972ef57c3edb1805dabd6c5612b90211Affected
LinuxLinux
  • 3.9Affected
  • before 3.9Not affected
  • 5.10.267 through 5.10.*Not affected
  • 5.15.218 through 5.15.*Not affected
  • 6.1.185 through 6.1.*Not affected
  • 6.6.154 through 6.6.*Not affected
  • 6.12.106 through 6.12.*Not affected
  • 6.18.47 through 6.18.*Not affected
  • 7.1.11 through 7.1.*Not affected
  • 7.2.1 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.