CVE-2026-31532

The Linux kernel's NFC/NCI subsystem can expose uninitialized kernel stack memory when processing crafted RF discovery or interface-activation notifications with zero-length technology-specific parameters. The affected handlers pass uninitialized data into NFC target records that can later be returned to user space.

The Linux kernel's NFC/NCI subsystem can write beyond its fixed-size discovered-target array when an NFC controller repeatedly restarts discovery and reports automatically activated targets. The unchecked target count causes a kernel heap out-of-bounds write and can also make subsequent code walk beyond the array.

An authentication state-management flaw in macOS Screen Sharing can allow a remote attacker to establish a session without valid credentials. Bynario demonstrated that the resulting unauthorized session could be chained with privileged Screen Sharing file-copy behavior to achieve remote root command execution.