{"id":"CVE-2026-90226","summary":"nfc: llcp: avoid userspace overflow on invalid optlen","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: avoid userspace overflow on invalid optlen\n\nnfc_llcp_getsockopt() casts optval to (u32 __user *) for put_user(), so\nthe kernel always stores 4 bytes regardless of the caller-supplied\noptlen. The existing min_t(u32, len, sizeof(u32)) only clamps the length\nreported back to userspace; it does not constrain the store. A call with\noptlen \u003c 4 therefore writes past the user buffer, violating the\ngetsockopt(2) contract for all five supported optnames.\n\nReject any call with optlen \u003c sizeof(u32) up front. 'len' is int, so a\nplain size comparison would promote a negative optlen to size_t and slip\npast the check; an explicit 'len \u003c 0' test is added first to catch\nnegative values before the size compare.","modified":"2026-09-19T03:47:30.955275248Z","published":"2026-09-17T16:07:35.322Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90226.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/35573c6cb081af2f4a7caeea291302aca5484526"},{"type":"WEB","url":"https://git.kernel.org/stable/c/42859562b7cc4313a84a584f338118edb7087066"},{"type":"WEB","url":"https://git.kernel.org/stable/c/598dcd53c52f8eeb9dd5382198c03960d5d40fcd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7e40f2f5e7bc06c3ddef781180ce4f7994176547"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67"},{"type":"WEB","url":"https://git.kernel.org/stable/c/99985bfa8336fadcc69190ba2dcbd5386af3d661"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b4c5abaea06292e1dddb70eac1b51589b32c77a3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bd6f1277b62bc1df348ca21739df2bc546fcd493"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90226.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90226"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"26fd76cab2e61cedc5c25f7151fb31b57ddc53c7"},{"fixed":"42859562b7cc4313a84a584f338118edb7087066"},{"fixed":"598dcd53c52f8eeb9dd5382198c03960d5d40fcd"},{"fixed":"7e40f2f5e7bc06c3ddef781180ce4f7994176547"},{"fixed":"35573c6cb081af2f4a7caeea291302aca5484526"},{"fixed":"b4c5abaea06292e1dddb70eac1b51589b32c77a3"},{"fixed":"8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67"},{"fixed":"bd6f1277b62bc1df348ca21739df2bc546fcd493"},{"fixed":"99985bfa8336fadcc69190ba2dcbd5386af3d661"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90226.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0"},{"fixed":"5.10.270"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90226.json"}}],"schema_version":"1.9.0"}