CVE-2026-80795

The Linux kernel's NFC/NCI subsystem can write beyond its fixed-size discovered-target array when an NFC controller repeatedly restarts discovery and reports automatically activated targets. The unchecked target count causes a kernel heap out-of-bounds write and can also make subsequent code walk beyond the array.

nci_target_auto_activated() appended entries to ndev->targets[NCI_MAX_DISCOVERED_TARGETS] and incremented ndev->n_targets without checking whether the array was already full. An NFC controller can repeatedly return the device to discovery and report another automatically activated target without causing the target list to be cleared, eventually driving the count beyond the array's capacity.

The fix adds the same bounds check already used by nci_add_new_target(). The vulnerability is classified as CWE-787 and was reproduced as a KASAN slab out-of-bounds write in nci_add_new_protocol().

References

• NVD record

• Linux stable fix