CVE-2026-80799

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-80799
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80799.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-80799
Downstream
AZL (1)
BELL (1)
DEBIAN (1)
MGASA (1)
openSUSE (1)
SUSE (3)
UBUNTU (1)
Related
openSUSE (1)
SUSE (3)
Published
2026-09-04T15:13:13Z
Modified
2026-10-17T10:11:58Z
Summary
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
Details

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related bugs in their TLV parsing loops:

  1. 'offset' is declared u8 but tlv_array_len is u16. When TLV data advances offset past 255 it silently wraps to zero, causing infinite loops or double-processing of buffer data.

  2. Before reading tlv[0] (type) and tlv[1] (length) there is no check that offset+2 <= tlv_array_len. A truncated TLV causes an OOB read of one byte past the buffer end.

  3. After reading the length field, the value bytes are accessed without checking offset+2+length <= tlv_array_len. A crafted length=0xFF on a short buffer causes up to 255 bytes of OOB read past the buffer end.

Both functions are reachable without authentication via nfc_llcp_set_remote_gb() which feeds remote LLCP general bytes directly into nfc_llcp_parse_gb_tlv() with no additional validation.

Fix all three issues by widening offset from u8 to u16 and adding bounds checks for both the TLV header and value field before each access.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80799.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0be9de2ea01e8d52646e7310a7eef5459cf07ea8
Fixed
2c1456fe09ab1a5a9fe1d8339ca6d509589b56e1
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3df40eb3a2ea58bf404a38f15a7a2768e4762cb0
Fixed
7f6f3d087c67a4346189ef2c36481455bbc59a74
Fixed
9c47d667963542c3cf8e3007b7f10c0904d08238
Fixed
a209334ed929941b20810c17c3a507445b0a7c85
Fixed
382eaa770335acf4f16a5a55524500f2bb4207df
Fixed
2d239590d1845a706304833d40dd6d4fec20ad88
Fixed
e84cdfdc4a6c88e8b751144458f2e04e24415a28
Fixed
875285a165fd3b402de2ab3be0deb355d6f4caf5
Fixed
78b20c8eeacd2e44a2d8a4cb5316d3c521d90911
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.188
Fixed
5.10.267
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.19.291
Fixed
4.20
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.4.251
Fixed
5.5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1deacb5e031e289ca5636f2db4fcae6612c05d34
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
66a1be74230bbe098e651766c9a0cf4038db8442

Affected versions

v4.*
v4.19.291
v4.19.292
v4.19.293
v4.19.294
v4.19.295
v4.19.296
v4.19.297
v4.19.298
v4.19.299
v4.19.300
v4.19.301
v4.19.302
v4.19.303
v4.19.304
v4.19.305
v4.19.306
v4.19.307
v4.19.308
v4.19.309
v4.19.310
v4.19.311
v4.19.312
v4.19.313
v4.19.314
v4.19.315
v4.19.316
v4.19.317
v4.19.318
v4.19.319
v4.19.320
v4.19.321
v4.19.322
v4.19.323
v4.19.324
v4.19.325
v5.*
v5.10.188
v5.10.189
v5.10.190
v5.10.191
v5.10.192
v5.10.193
v5.10.194
v5.10.195
v5.10.196
v5.10.197
v5.10.198
v5.10.199
v5.10.200
v5.10.201
v5.10.202
v5.10.203
v5.10.204
v5.10.205
v5.10.206
v5.10.207
v5.10.208
v5.10.209
v5.10.210
v5.10.211
v5.10.212
v5.10.213
v5.10.214
v5.10.215
v5.10.216
v5.10.217
v5.10.218
v5.10.219
v5.10.220
v5.10.221
v5.10.222
v5.10.223
v5.10.224
v5.10.225
v5.10.226
v5.10.227
v5.10.228
v5.10.229
v5.10.230
v5.10.231
v5.10.232
v5.10.233
v5.10.234
v5.10.235
v5.10.236
v5.10.237
v5.10.238
v5.10.239
v5.10.240
v5.10.241
v5.10.242
v5.10.243
v5.10.244
v5.10.245
v5.10.246
v5.10.247
v5.10.248
v5.10.249
v5.10.250
v5.10.251
v5.10.252
v5.10.253
v5.10.254
v5.10.255
v5.10.256
v5.10.257
v5.10.258
v5.10.259
v5.10.260
v5.10.261
v5.10.262
v5.10.263
v5.10.264
v5.10.265
v5.10.266
v5.4.251
v5.4.252
v5.4.253
v5.4.254
v5.4.255
v5.4.256
v5.4.257
v5.4.258
v5.4.259
v5.4.260
v5.4.261
v5.4.262
v5.4.263
v5.4.264
v5.4.265
v5.4.266
v5.4.267
v5.4.268
v5.4.269
v5.4.270
v5.4.271
v5.4.272
v5.4.273
v5.4.274
v5.4.275
v5.4.276
v5.4.277
v5.4.278
v5.4.279
v5.4.280
v5.4.281
v5.4.282
v5.4.283
v5.4.284
v5.4.285
v5.4.286
v5.4.287
v5.4.288
v5.4.289
v5.4.290
v5.4.291
v5.4.292
v5.4.293
v5.4.294
v5.4.295
v5.4.296
v5.4.297
v5.4.298
v5.4.299
v5.4.300
v5.4.301
v5.4.302

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80799.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.10.267
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.218
Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
6.1.185
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.6.154
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.12.106
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.18.47
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
7.1.11
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80799.json"