CVE-2026-31622

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31622", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.124Z", "datePublished": "2026-04-24T14:42:39.916Z", "dateUpdated": "2026-10-15T01:17:15.197Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:52.282Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: digital: Bounds check NFC-A cascade depth in SDD response handler\n\nThe NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3\nor 4 bytes to target->nfcid1 on each round, but the number of cascade\nrounds is controlled entirely by the peer device. The peer sets the\ncascade tag in the SDD_RES (deciding 3 vs 4 bytes) and the\ncascade-incomplete bit in the SEL_RES (deciding whether another round\nfollows).\n\nISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is\nsized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driver\nactually enforces this. This means a malicious peer can keep the\ncascade running, writing past the heap-allocated nfc_target with each\nround.\n\nFix this by rejecting the response when the accumulated UID would exceed\nthe buffer.\n\nCommit e329e71013c9 (\"NFC: nci: Bounds check struct nfc_target arrays\")\nfixed similar missing checks against the same field on the NCI path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable code processes NFC-A anti-collision responses from a peer/tag in the local NFC RF field, so the attacker must be within NFC proximity rather than on an IP network.\nAC:L - The peer controls both the cascade tag in SDD_RES and the cascade-incomplete bit in SEL_RES, and can repeat valid BCC/CRC responses to drive the overflow without a race or unusual memory state.\nPR:N - The malicious NFC peer does not need local credentials or kernel privileges; any local CAP_NET_ADMIN requirement only applies to the victim system component that starts polling.\nUI:N - In a reasonable high-impact deployment such as an NFC reader, kiosk, or access-control device, polling is already active and the attacker only needs to present the malicious NFC peer.\nS:U - The corruption occurs in the host kernel NFC stack and impacts the same kernel security authority, with no VM, IOMMU, or separate sandbox boundary crossed.\nC:H - This is a peer-controlled heap out-of-bounds write past struct nfc_target, and such kernel memory corruption is defensibly exploitable for information disclosure or arbitrary memory access.\nI:H - The bug writes attacker-controlled NFCID bytes beyond the fixed nfcid1 buffer and can continue across cascade rounds, making kernel memory corruption and control-flow/data integrity compromise plausible.\nA:H - Even without full exploitation, overflowing a heap-allocated kernel object from NFC response handling can corrupt adjacent state and cause an oops, panic, or persistent crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/digital_technology.c"], "versions": [{"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "9ba6bb09e00b922d902f684f575779e5433fe6e3", "status": "affected", "versionType": "git"}, {"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "f83b399aa05a0712e3b1569a30d3d90b3533d2ef", "status": "affected", "versionType": "git"}, {"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "20663102c14566e900e1d2f679e30b7f1694f387", "status": "affected", "versionType": "git"}, {"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "2819f34e08bdffb6f06a51c67948ec5737fb166a", "status": "affected", "versionType": "git"}, {"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "1bec5698b55aa2be5c3b983dba657c01d0fd3dbc", "status": "affected", "versionType": "git"}, {"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1", "status": "affected", "versionType": "git"}, {"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "8d9d9bf3565271ca7ab9c716a94e87296177e7ba", "status": "affected", "versionType": "git"}, {"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "cc024a3de265ef6c58957f4990eccb9f806208cb", "status": "affected", "versionType": "git"}, {"version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "lessThan": "46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/digital_technology.c"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9ba6bb09e00b922d902f684f575779e5433fe6e3"}, {"url": "https://git.kernel.org/stable/c/f83b399aa05a0712e3b1569a30d3d90b3533d2ef"}, {"url": "https://git.kernel.org/stable/c/20663102c14566e900e1d2f679e30b7f1694f387"}, {"url": "https://git.kernel.org/stable/c/2819f34e08bdffb6f06a51c67948ec5737fb166a"}, {"url": "https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc"}, {"url": "https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1"}, {"url": "https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba"}, {"url": "https://git.kernel.org/stable/c/cc024a3de265ef6c58957f4990eccb9f806208cb"}, {"url": "https://git.kernel.org/stable/c/46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1"}], "title": "NFC: digital: Bounds check NFC-A cascade depth in SDD response handler", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:15.197Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/nfc/digital_technology.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9ba6bb09e00b922d902f684f575779e5433fe6e3", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}, {"lessThan": "f83b399aa05a0712e3b1569a30d3d90b3533d2ef", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}, {"lessThan": "20663102c14566e900e1d2f679e30b7f1694f387", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}, {"lessThan": "2819f34e08bdffb6f06a51c67948ec5737fb166a", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}, {"lessThan": "1bec5698b55aa2be5c3b983dba657c01d0fd3dbc", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}, {"lessThan": "5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}, {"lessThan": "8d9d9bf3565271ca7ab9c716a94e87296177e7ba", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}, {"lessThan": "cc024a3de265ef6c58957f4990eccb9f806208cb", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}, {"lessThan": "46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1", "status": "affected", "version": "2c66daecc4092e6049673c281b2e6f0d5e59a94c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/nfc/digital_technology.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E4B7C62-D2BF-4255-BC77-4D30A01DC46D", "versionEndExcluding": "6.6.136", "versionStartIncluding": "3.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: digital: Bounds check NFC-A cascade depth in SDD response handler\n\nThe NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3\nor 4 bytes to target->nfcid1 on each round, but the number of cascade\nrounds is controlled entirely by the peer device. The peer sets the\ncascade tag in the SDD_RES (deciding 3 vs 4 bytes) and the\ncascade-incomplete bit in the SEL_RES (deciding whether another round\nfollows).\n\nISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is\nsized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driver\nactually enforces this. This means a malicious peer can keep the\ncascade running, writing past the heap-allocated nfc_target with each\nround.\n\nFix this by rejecting the response when the accumulated UID would exceed\nthe buffer.\n\nCommit e329e71013c9 (\"NFC: nci: Bounds check struct nfc_target arrays\")\nfixed similar missing checks against the same field on the NCI path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nNFC: digital: Comprobaci\u00f3n de l\u00edmites de la profundidad de cascada NFC-A en el gestor de respuesta SDD\n\nLa cascada anticolisi\u00f3n NFC-A en digital_in_recv_sdd_res() a\u00f1ade 3 o 4 bytes a target -> nfcid1 en cada ronda, pero el n\u00famero de rondas de cascada es controlado completamente por el dispositivo par. El par establece la etiqueta de cascada en el SDD_RES (decidiendo 3 frente a 4 bytes) y el bit de cascada incompleta en el SEL_RES (decidiendo si sigue otra ronda).\n\nISO 14443-3 limita NFC-A a tres niveles de cascada y target -> nfcid1 tiene un tama\u00f1o acorde (NFC_NFCID1_MAXSIZE = 10), pero nada en el controlador realmente lo aplica. Esto significa que un par malicioso puede mantener la cascada en ejecuci\u00f3n, escribiendo m\u00e1s all\u00e1 del nfc_target asignado en el heap con cada ronda.\n\nSolucione esto rechazando la respuesta cuando el UID acumulado exceder\u00eda el b\u00fafer.\n\nEl commit e329e71013c9 (\u2019NFC: nci: Comprobaci\u00f3n de l\u00edmites de arrays de struct nfc_target\u2019) corrigi\u00f3 comprobaciones faltantes similares contra el mismo campo en la ruta NCI."}], "id": "CVE-2026-31622", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-24T15:16:41.487", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20663102c14566e900e1d2f679e30b7f1694f387"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2819f34e08bdffb6f06a51c67948ec5737fb166a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ba6bb09e00b922d902f684f575779e5433fe6e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc024a3de265ef6c58957f4990eccb9f806208cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f83b399aa05a0712e3b1569a30d3d90b3533d2ef"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler", "id": "2461459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461459"}, "csaw": false, "cwe": "CWE-120", "details": ["A flaw was found in the Linux kernel's NFC (Near Field Communication) digital subsystem. A malicious peer device can exploit this vulnerability by sending specially crafted NFC-A anti-collision cascade responses. This allows the peer to exceed the intended cascade depth, leading to a heap overflow by writing past the allocated buffer for the nfc_target. This memory corruption can result in a denial of service or potentially arbitrary code execution."], "name": "CVE-2026-31622", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31622\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31622\nhttps://lore.kernel.org/linux-cve-announce/2026042426-CVE-2026-31622-dc00@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c66daecc4092e6049673c281b2e6f0d5e59a94c,2819f34e08bdffb6f06a51c67948ec5737fb166a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c66daecc4092e6049673c281b2e6f0d5e59a94c,1bec5698b55aa2be5c3b983dba657c01d0fd3dbc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c66daecc4092e6049673c281b2e6f0d5e59a94c,5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c66daecc4092e6049673c281b2e6f0d5e59a94c,8d9d9bf3565271ca7ab9c716a94e87296177e7ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c66daecc4092e6049673c281b2e6f0d5e59a94c,cc024a3de265ef6c58957f4990eccb9f806208cb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c66daecc4092e6049673c281b2e6f0d5e59a94c,46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.1,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T13:57:34.360682+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to a version that includes the bounds\u2011checking commit for NFC\u2011A cascade depth.", "If an immediate kernel upgrade is not possible, disable NFC support by removing or masking the relevant kernel modules or via sysfs options so that the driver does not process external NFC traffic.", "Verify that the kernel configuration does not enable the NFC stack unless it is required for the system\u2019s operation, reducing the exposure to malicious NFC peers."], "summary": {"action": "Apply patch", "impact": "Buffer overflow potential"}, "threat_synthesis": {"affected_systems": "Linux kernel builds that enable the NFC digital driver are affected. The flaw exists in any kernel release before the commit that introduces bounds checking for the nfc_target arrays, which was merged for all standard distributions after the vulnerability was reported. Systems that have not upgraded to a patched kernel will still be vulnerable.", "description_and_impact": "The Linux kernel NFC driver accepts a cascade depth for NFC\u2011A anti\u2011collision that is driven entirely by the peer device, without checking against the three\u2011level limit defined by ISO 14443\u20113. If a malicious partner keeps the cascade in motion, the driver appends three or four bytes to the target->nfcid1 field on each pass. Because target->nfcid1 is sized for only ten bytes, repeated rounds can overwrite adjacent heap memory. The CVE description states that the driver allows this overflow, implying a buffer overflow condition; however, the description does not explicitly confirm that this leads to arbitrary code execution, so that outcome is an inference.", "risk_and_exploitability": "The vulnerability received a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1% suggests that, at the time of analysis, exploitation attempts are infrequent. The most probable attack vector involves a physically proximate NFC\u2011capable device able to send a specially crafted message to the target system. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploit has been documented."}}}}, "created": "2026-04-27T21:45:14.293390+00:00", "updated": "2026-04-28T14:00:16.508630+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}