SB2026042593 - Heap-based buffer overflow in Linux kernel nfc

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-31622)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in digital_in_recv_sdd_res() when processing crafted NFC-A SDD and SEL responses from a peer device. A remote attacker can send crafted responses to cause a denial of service.

The issue occurs because the peer device can control the number of NFC-A anti-collision cascade rounds and the amount of data appended to target->nfcid1 on each round.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc
• https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1
• https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba
• https://git.kernel.org/stable/c/cc024a3de265ef6c58957f4990eccb9f806208cb