AZL-99497
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99497.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-99497
- Upstream
- Published
- 2026-09-04T16:18:05Z
- Modified
- 2026-09-05T14:17:03.896538559Z
- Summary
- CVE-2026-80794 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
ncirfdiscoverntfpacket() and ncirfintfactivatedntfpacket() each parse a notification into an on-stack struct (ncirfdiscoverntf / ncirfintfactivatedntf) that is not initialised. The RF technology-specific parameters are only extracted when rftechspecificparamslen is non-zero, so a notification that reports a zero length leaves the rftechspecificparams union uninitialised - and both handlers then pass it to nciaddnewprotocol(), which reads it:
- discover: nciaddnewtarget() -> nciaddnewprotocol();
- activated: ncitargetautoactivated() -> nciaddnewprotocol().
nciaddnewprotocol() uses nfcapoll->nfcid1len as both a branch condition and a memcpy() length and copies nfcid1/sensres/selres into ndev->targets, which is later exposed to user space via NFCCMDGETTARGET.
BUG: KMSAN: uninit-value in nciaddnewprotocol+0x624/0x6c0 nciaddnewprotocol+0x624/0x6c0 ncintfpacket+0x25b2/0x3c30 ncirxwork+0x318/0x5d0 processscheduledworks+0x84b/0x17a0 workerthread+0xc10/0x11b0 kthread+0x376/0x500 Local variable ntf.i created at: ncintf_packet+0xbc2/0x3c30
Zero-initialise both on-stack notifications so the union reads back as zero when no technology-specific parameters are present.
- References