{"id":"CVE-2026-80799","summary":"nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix OOB read and u8 offset wrap in TLV parsers\n\nnfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain\nthree related bugs in their TLV parsing loops:\n\n1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data\n   advances offset past 255 it silently wraps to zero, causing\n   infinite loops or double-processing of buffer data.\n\n2. Before reading tlv[0] (type) and tlv[1] (length) there is no\n   check that offset+2 \u003c= tlv_array_len. A truncated TLV causes\n   an OOB read of one byte past the buffer end.\n\n3. After reading the length field, the value bytes are accessed\n   without checking offset+2+length \u003c= tlv_array_len. A crafted\n   length=0xFF on a short buffer causes up to 255 bytes of OOB\n   read past the buffer end.\n\nBoth functions are reachable without authentication via\nnfc_llcp_set_remote_gb() which feeds remote LLCP general bytes\ndirectly into nfc_llcp_parse_gb_tlv() with no additional\nvalidation.\n\nFix all three issues by widening offset from u8 to u16 and adding\nbounds checks for both the TLV header and value field before each\naccess.","modified":"2026-10-28T02:31:08.238818912Z","published":"2026-09-04T15:13:13.311Z","related":["SUSE-SU-2026:24181-1","SUSE-SU-2026:24182-1","SUSE-SU-2026:24315-1","SUSE-SU-2026:24316-1","SUSE-SU-2026:4640-1","SUSE-SU-2026:4660-1","SUSE-SU-2026:4706-1","openSUSE-SU-2026:11773-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80799.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2c1456fe09ab1a5a9fe1d8339ca6d509589b56e1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2d239590d1845a706304833d40dd6d4fec20ad88"},{"type":"WEB","url":"https://git.kernel.org/stable/c/382eaa770335acf4f16a5a55524500f2bb4207df"},{"type":"WEB","url":"https://git.kernel.org/stable/c/78b20c8eeacd2e44a2d8a4cb5316d3c521d90911"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7f6f3d087c67a4346189ef2c36481455bbc59a74"},{"type":"WEB","url":"https://git.kernel.org/stable/c/875285a165fd3b402de2ab3be0deb355d6f4caf5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9c47d667963542c3cf8e3007b7f10c0904d08238"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a209334ed929941b20810c17c3a507445b0a7c85"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e84cdfdc4a6c88e8b751144458f2e04e24415a28"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80799.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80799"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0be9de2ea01e8d52646e7310a7eef5459cf07ea8"},{"fixed":"2c1456fe09ab1a5a9fe1d8339ca6d509589b56e1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3df40eb3a2ea58bf404a38f15a7a2768e4762cb0"},{"fixed":"7f6f3d087c67a4346189ef2c36481455bbc59a74"},{"fixed":"9c47d667963542c3cf8e3007b7f10c0904d08238"},{"fixed":"a209334ed929941b20810c17c3a507445b0a7c85"},{"fixed":"382eaa770335acf4f16a5a55524500f2bb4207df"},{"fixed":"2d239590d1845a706304833d40dd6d4fec20ad88"},{"fixed":"e84cdfdc4a6c88e8b751144458f2e04e24415a28"},{"fixed":"875285a165fd3b402de2ab3be0deb355d6f4caf5"},{"fixed":"78b20c8eeacd2e44a2d8a4cb5316d3c521d90911"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.188"},{"fixed":"5.10.267"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.19.291"},{"fixed":"4.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.4.251"},{"fixed":"5.5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1deacb5e031e289ca5636f2db4fcae6612c05d34"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"66a1be74230bbe098e651766c9a0cf4038db8442"}]}],"versions":["v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.10.248","v5.10.247","v5.10.246","v5.10.245","v5.10.244","v5.10.243","v5.10.242","v5.10.241","v5.10.240","v5.10.239","v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.10.232","v5.10.231","v5.10.230","v5.10.229","v5.10.228","v5.10.227","v5.10.226","v5.10.225","v5.10.224","v5.10.223","v5.10.222","v5.10.221","v5.10.220","v5.10.219","v5.10.218","v5.10.217","v5.10.216","v5.10.215","v5.10.214","v5.10.213","v5.10.212","v5.10.211","v5.10.210","v5.10.209","v5.10.208","v5.10.207","v5.10.206","v5.10.205","v5.10.204","v5.10.203","v5.10.202","v5.10.201","v5.10.200","v5.10.199","v5.10.198","v5.10.197","v5.10.196","v5.10.195","v5.10.194","v5.10.193","v5.10.192","v5.10.191","v5.10.190","v5.10.189","v5.10.188","v4.19.325","v4.19.324","v4.19.323","v4.19.322","v4.19.321","v4.19.320","v4.19.319","v4.19.318","v4.19.317","v4.19.316","v4.19.315","v4.19.314","v4.19.313","v4.19.312","v4.19.311","v4.19.310","v4.19.309","v4.19.308","v4.19.307","v4.19.306","v4.19.305","v4.19.304","v4.19.303","v4.19.302","v4.19.301","v4.19.300","v4.19.299","v4.19.298","v4.19.297","v4.19.296","v4.19.295","v4.19.294","v4.19.293","v4.19.292","v4.19.291","v5.4.302","v5.4.301","v5.4.300","v5.4.299","v5.4.298","v5.4.297","v5.4.296","v5.4.295","v5.4.294","v5.4.293","v5.4.292","v5.4.291","v5.4.290","v5.4.289","v5.4.288","v5.4.287","v5.4.286","v5.4.285","v5.4.284","v5.4.283","v5.4.282","v5.4.281","v5.4.280","v5.4.279","v5.4.278","v5.4.277","v5.4.276","v5.4.275","v5.4.274","v5.4.273","v5.4.272","v5.4.271","v5.4.270","v5.4.269","v5.4.268","v5.4.267","v5.4.266","v5.4.265","v5.4.264","v5.4.263","v5.4.262","v5.4.261","v5.4.260","v5.4.259","v5.4.258","v5.4.257","v5.4.256","v5.4.255","v5.4.254","v5.4.253","v5.4.252","v5.4.251"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80799.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.267"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.218"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.15.0"},{"fixed":"6.1.185"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.6.154"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.12.106"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.18.47"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"7.1.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80799.json"}}],"schema_version":"1.9.2"}