In the Linux kernel, the following vulnerability has been resolved:
nfc: hci: fix out-of-bounds read in HCP header parsing
Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read
packet->header from skb->data at function entry without first checking
that the buffer holds at least one byte. A malicious NFC peer can send
a 0-byte HCP frame that passes through the SHDLC layer and reaches
these functions, causing an out-of-bounds heap read of packet->header.
The same 0-byte frame, if queued as a non-final fragment, also causes
the reassembly loop to underflow msg_len to UINT_MAX, triggering
skb_over_panic() when the reassembled skb is written.
Fix this by adding a pskb_may_pull() check at the entry of each
function before packet->header is first accessed. The existing
pskb_may_pull() checks before the reassembled hcp_skb is cast to
struct hcp_packet remain in place to guard the 2-byte HCP message
header.
References
Configurations
Configuration 1 (hide)
|
History
30 Oct 2026, 17:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/1905f5ec3641b2b234bb63549c8ca11ab85466eb - Patch | |
| References | () https://git.kernel.org/stable/c/22d41b176b9989efd21c3b2d3abf6728f05b9d9a - Patch | |
| References | () https://git.kernel.org/stable/c/37382293f174b82a0616c8295e32b1fc8e13d1ed - Patch | |
| References | () https://git.kernel.org/stable/c/83b1362edc9d6ae376c6f36da116e2c70f2e70a6 - Patch | |
| References | () https://git.kernel.org/stable/c/b99366d74b535d0cadb1ef73e04639415d9ff3b7 - Patch | |
| References | () https://git.kernel.org/stable/c/c4cc6b3b0013acb3ed0b2b60e57dfae98647fe98 - Patch | |
| References | () https://git.kernel.org/stable/c/ed6d5d97dad0334a7f43d218753429cbe2f70a4f - Patch | |
| References | () https://git.kernel.org/stable/c/f040e590c035bfd9553fe79ee9585caf1b14d67b - Patch | |
| CWE | CWE-125 | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-30 17:44
NVD link : CVE-2026-63915
Mitre link : CVE-2026-63915
CVE.ORG link : CVE-2026-63915
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-125
Out-of-bounds Read