In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target. Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy. Found by 0sec automated security-research tooling (https://0sec.ai).

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/31aa28ed732f66ab83c40ef53d99791be69b85c4 cve-icon cve-icon
https://git.kernel.org/stable/c/344a56d7c8e0f3cbaff0bcb1bcd95a1a1db24b16 cve-icon cve-icon
https://git.kernel.org/stable/c/4e942da2869bcd646353eef706b7dd82efeb9db5 cve-icon cve-icon
https://git.kernel.org/stable/c/6afb29751ee731e7f7a96feb8a15f91441e552ba cve-icon cve-icon
https://git.kernel.org/stable/c/a1ef9bddfbb3ae42b036c5aa16cf386d78db70b6 cve-icon cve-icon
https://git.kernel.org/stable/c/a56773e649ea99b344d6bbaf90f34c8e3fadef5d cve-icon cve-icon
https://git.kernel.org/stable/c/af4c0606f743e009254a8d252096855335ade85d cve-icon cve-icon
https://git.kernel.org/stable/c/d0756a98277e383c26fead988a96c91f0781cd7f cve-icon cve-icon
https://git.kernel.org/stable/c/e886c63d2ca7108826076989103a1ffa8a0bb8f4 cve-icon cve-icon
History

Fri, 04 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-125

Fri, 04 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte target.sensf_res field without an upper-bound check. A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target. Clamp resp->len to NFC_SENSF_RES_MAXSIZE before the copy. Found by 0sec automated security-research tooling (https://0sec.ai).
Title nfc: digital: clamp SENSF_RES length to the destination buffer
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:13:17.298Z

Updated: 2026-09-04T15:13:17.298Z

Reserved: 2026-08-26T14:34:25.794Z

Link: CVE-2026-80803

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T16:18:07.250

Modified: 2026-09-04T16:18:07.250

Link: CVE-2026-80803

cve-icon Redhat

No data.