CVE-2026-63915

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: fix out-of-bounds read in HCP header parsing

Both nfchcirecvfromllc() and ncihcidatareceivedcb() read packet->header from skb->data at function entry without first checking that the buffer holds at least one byte. A malicious NFC peer can send a 0-byte HCP frame that passes through the SHDLC layer and reaches these functions, causing an out-of-bounds heap read of packet->header. The same 0-byte frame, if queued as a non-final fragment, also causes the reassembly loop to underflow msglen to UINTMAX, triggering skboverpanic() when the reassembled skb is written.

Fix this by adding a pskbmaypull() check at the entry of each function before packet->header is first accessed. The existing pskbmaypull() checks before the reassembled hcpskb is cast to struct hcppacket remain in place to guard the 2-byte HCP message header.