CVE-2026-80794

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix uninit-value in the RF discover/activated NTF handlers

ncirfdiscoverntfpacket() and ncirfintfactivatedntfpacket() each parse a notification into an on-stack struct (ncirfdiscoverntf / ncirfintfactivatedntf) that is not initialised. The RF technology-specific parameters are only extracted when rftechspecificparamslen is non-zero, so a notification that reports a zero length leaves the rftechspecificparams union uninitialised - and both handlers then pass it to nciaddnewprotocol(), which reads it:

• discover: nciaddnewtarget() -> nciaddnewprotocol();
• activated: ncitargetautoactivated() -> nciaddnewprotocol().

nciaddnewprotocol() uses nfcapoll->nfcid1len as both a branch condition and a memcpy() length and copies nfcid1/sensres/selres into ndev->targets, which is later exposed to user space via NFCCMDGETTARGET.

BUG: KMSAN: uninit-value in nciaddnewprotocol+0x624/0x6c0 nciaddnewprotocol+0x624/0x6c0 ncintfpacket+0x25b2/0x3c30 ncirxwork+0x318/0x5d0 processscheduledworks+0x84b/0x17a0 workerthread+0xc10/0x11b0 kthread+0x376/0x500 Local variable ntf.i created at: ncintf_packet+0xbc2/0x3c30

Zero-initialise both on-stack notifications so the union reads back as zero when no technology-specific parameters are present.