CVE-2026-80803

nfc: digital: clamp SENSF_RES length to the destination buffer

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: digital: clamp SENSF_RES length to the destination buffer

digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target.

Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy.

Found by 0sec automated security-research tooling (https://0sec.ai).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8c0695e4998dd268ff2a05951961247b7e015651 to before 6afb29751ee731e7f7a96feb8a15f91441e552baAffected 8c0695e4998dd268ff2a05951961247b7e015651 to before e886c63d2ca7108826076989103a1ffa8a0bb8f4Affected 8c0695e4998dd268ff2a05951961247b7e015651 to before 4e942da2869bcd646353eef706b7dd82efeb9db5Affected 8c0695e4998dd268ff2a05951961247b7e015651 to before d0756a98277e383c26fead988a96c91f0781cd7fAffected 8c0695e4998dd268ff2a05951961247b7e015651 to before af4c0606f743e009254a8d252096855335ade85dAffected 8c0695e4998dd268ff2a05951961247b7e015651 to before a56773e649ea99b344d6bbaf90f34c8e3fadef5dAffected 8c0695e4998dd268ff2a05951961247b7e015651 to before a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6Affected 8c0695e4998dd268ff2a05951961247b7e015651 to before 31aa28ed732f66ab83c40ef53d99791be69b85c4Affected 8c0695e4998dd268ff2a05951961247b7e015651 to before 344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16Affected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.267 through 5.10.Not affected 5.15.218 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.154 through 6.6.Not affected 6.12.106 through 6.12.Not affected 6.18.47 through 6.18.Not affected 7.1.11 through 7.1.Not affected 7.2.1 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

8c0695e4998dd268ff2a05951961247b7e015651 to before 6afb29751ee731e7f7a96feb8a15f91441e552baAffected
8c0695e4998dd268ff2a05951961247b7e015651 to before e886c63d2ca7108826076989103a1ffa8a0bb8f4Affected
8c0695e4998dd268ff2a05951961247b7e015651 to before 4e942da2869bcd646353eef706b7dd82efeb9db5Affected
8c0695e4998dd268ff2a05951961247b7e015651 to before d0756a98277e383c26fead988a96c91f0781cd7fAffected
8c0695e4998dd268ff2a05951961247b7e015651 to before af4c0606f743e009254a8d252096855335ade85dAffected
8c0695e4998dd268ff2a05951961247b7e015651 to before a56773e649ea99b344d6bbaf90f34c8e3fadef5dAffected
8c0695e4998dd268ff2a05951961247b7e015651 to before a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6Affected
8c0695e4998dd268ff2a05951961247b7e015651 to before 31aa28ed732f66ab83c40ef53d99791be69b85c4Affected
8c0695e4998dd268ff2a05951961247b7e015651 to before 344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16Affected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.267 through 5.10.*Not affected
5.15.218 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.154 through 6.6.*Not affected
6.12.106 through 6.12.*Not affected
6.18.47 through 6.18.*Not affected
7.1.11 through 7.1.*Not affected
7.2.1 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.