CVE-2026-80794

The Linux kernel's NFC/NCI subsystem can expose uninitialized kernel stack memory when processing crafted RF discovery or interface-activation notifications with zero-length technology-specific parameters. The affected handlers pass uninitialized data into NFC target records that can later be returned to user space.

Both nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() parse notifications into stack structures that were not initialized. When a notification reports no RF technology-specific parameters, the corresponding union remains uninitialized, but is still read by nci_add_new_protocol(). Values copied from that union can reach ndev->targets and be exposed through NFC_CMD_GET_TARGET; the activation handler can also expose uninitialized activation parameters through the target ATS attribute.

The fix zero-initializes both notification structures before parsing. The issue is classified as CWE-908.

References

• NVD record

• Linux stable fix