CVE-2026-80803

nfc: digital: clamp SENSF_RES length to the destination buffer

Published Sep 4, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: digital: clamp SENSF_RES length to the destination buffer

digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote
NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res
field without an upper-bound check. A nearby malicious NFC-F device can
send an oversized SENSF_RES response to overflow the stack-local struct
nfc_target.

Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy.

Found by 0sec automated security-research tooling (https://0sec.ai).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< 6afb29751ee731e7f7a96feb8a15f91441e552ba
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< e886c63d2ca7108826076989103a1ffa8a0bb8f4
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< 4e942da2869bcd646353eef706b7dd82efeb9db5
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< d0756a98277e383c26fead988a96c91f0781cd7f
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< af4c0606f743e009254a8d252096855335ade85d
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< a56773e649ea99b344d6bbaf90f34c8e3fadef5d
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< 31aa28ed732f66ab83c40ef53d99791be69b85c4
`8c0695e4998dd268ff2a05951961247b7e015651`	affected	< 344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16

Linux

affected

Version	Status	Constraints
`3.13`	affected	—
`0`	unaffected	< 3.13
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[8c0695e4998dd268ff2a05951961247b7e015651,6afb29751ee731e7f7a96feb8a15f91441e552ba)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,e886c63d2ca7108826076989103a1ffa8a0bb8f4)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,4e942da2869bcd646353eef706b7dd82efeb9db5)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,d0756a98277e383c26fead988a96c91f0781cd7f)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,af4c0606f743e009254a8d252096855335ade85d)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,a56773e649ea99b344d6bbaf90f34c8e3fadef5d)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,31aa28ed732f66ab83c40ef53d99791be69b85c4)`	affected	code_commit	—
`[8c0695e4998dd268ff2a05951961247b7e015651,344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.13`	affected	generic	—
`[0,3.13)`	unaffected	generic	—
`[5.10.267,5.11.0)`	unaffected	semver	—
`[5.15.218,5.16.0)`	unaffected	semver	—
`[6.1.185,6.2.0)`	unaffected	semver	—
`[6.6.154,6.7.0)`	unaffected	semver	—
`[6.12.106,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.195% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/31aa28ed732f66ab83c40ef53d99791be69b85c4
https://git.kernel.org/stable/c/344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16
https://git.kernel.org/stable/c/4e942da2869bcd646353eef706b7dd82efeb9db5
https://git.kernel.org/stable/c/6afb29751ee731e7f7a96feb8a15f91441e552ba
https://git.kernel.org/stable/c/a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6
https://git.kernel.org/stable/c/a56773e649ea99b344d6bbaf90f34c8e3fadef5d
https://git.kernel.org/stable/c/af4c0606f743e009254a8d252096855335ade85d
https://git.kernel.org/stable/c/d0756a98277e383c26fead988a96c91f0781cd7f
https://git.kernel.org/stable/c/e886c63d2ca7108826076989103a1ffa8a0bb8f4

History

Sep 4, 2026 6:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-120 CWE-125

Sep 4, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target. Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy. Found by 0sec automated security-research tooling (https://0sec.ai).
Title		nfc: digital: clamp SENSF_RES length to the destination buffer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/31aa28ed732f66ab83c40ef53d99791be69b85c4 https://git.kernel.org/stable/c/344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16 https://git.kernel.org/stable/c/4e942da2869bcd646353eef706b7dd82efeb9db5 https://git.kernel.org/stable/c/6afb29751ee731e7f7a96feb8a15f91441e552ba https://git.kernel.org/stable/c/a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6 https://git.kernel.org/stable/c/a56773e649ea99b344d6bbaf90f34c8e3fadef5d https://git.kernel.org/stable/c/af4c0606f743e009254a8d252096855335ade85d https://git.kernel.org/stable/c/d0756a98277e383c26fead988a96c91f0781cd7f https://git.kernel.org/stable/c/e886c63d2ca7108826076989103a1ffa8a0bb8f4