Heimdall Security Logo

CVE-2026-80798

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : 7.2.1, 6.1.185, <=6.1.*, 7.1.11, <=6.12.*, 6.12.106, 0, 5.10.267, <=7.1.*, 6.6.154, <95674f506c6376d6722a23144c9acd26609771ed, <3.3, <e969e98410051b1ef8cc318bfe0c7e3f24ec766d, <=5.10.*, <=6.6.*, <f36cffea24bf3e2cc29a00d4b51dbcadc087d810, <=6.18.*, d646960f7986fefb460a2b062d5ccc8ccfeacc3a, <ae5f20f5842f440b72d030e3a34fe182dd8eae42, <eab47618e282602197db287ecbd1b09d356a2515, 3.3, 6.18.47, <d3d90243393c48146911c67fd3792b549d21d9e6, <=7.2.*, <3793d768b40f38bb97265dd5b9a8b8655c4e1b1d, <e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82, <=*, <=5.15.*, <a7b9b449f5a5132221fff6adc11a9431ab8cd914, 5.15.218, 7.3

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the receive path never checked that a frame is at least LLCP_HEADER_SIZE bytes before parsing it. nfc_llcp_rx_skb() reads the header via nfc_llcp_ptype()/nfc_llcp_dsap()/ nfc_llcp_ssap(), which dereference pdu->data[0] and pdu->data[1], and a CONNECT or CC PDU then computes tlv_array_len = skb->len - LLCP_HEADER_SIZE; as a size_t and hands it to the TLV walk. When the frame is shorter than the header the subtraction wraps to a huge value and the walk runs far past the buffer, an out-of-bounds read. A nearby NFC device can reach this without authentication; LLCP link activation happens automatically after NFC-DEP. Guard the common receive choke point __nfc_llcp_recv(), shared by both the target (nfc_llcp_data_received()) and initiator (nfc_llcp_recv()) paths, so a short skb is dropped before the rx_work worker parses it. Use pskb_may_pull() rather than a skb->len test so the two header bytes are guaranteed to sit in the skb linear area even for a non-linear skb, matching how the sibling NCI and HCI receive paths validate their headers. Reproduced with a KFENCE out-of-bounds read via /dev/virtual_nci on linux-next. Found by 0sec automated security-research tooling (https://0sec.ai).

Gravité et risque d'exploitation

CVE-2026-80798 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.23 %, ce qui la place devant 13.4 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions 7.2.1, 6.1.185, <=6.1.*, 7.1.11, <=6.12.*, 6.12.106, 0, 5.10.267, <=7.1.*, 6.6.154, <95674f506c6376d6722a23144c9acd26609771ed, <3.3, <e969e98410051b1ef8cc318bfe0c7e3f24ec766d, <=5.10.*, <=6.6.*, <f36cffea24bf3e2cc29a00d4b51dbcadc087d810, <=6.18.*, d646960f7986fefb460a2b062d5ccc8ccfeacc3a, <ae5f20f5842f440b72d030e3a34fe182dd8eae42, <eab47618e282602197db287ecbd1b09d356a2515, 3.3, 6.18.47, <d3d90243393c48146911c67fd3792b549d21d9e6, <=7.2.*, <3793d768b40f38bb97265dd5b9a8b8655c4e1b1d, <e6ec76a68dce04884dfeccfe5a5f0e9f67c0ec82, <=*, <=5.15.*, <a7b9b449f5a5132221fff6adc11a9431ab8cd914, 5.15.218, 7.3) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE