Out-of-bounds read in Linux kernel - CVE-2026-80802
Published: September 5, 2026
Vulnerability identifier: #VU147112
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80802
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to improper validation of a device-reported length in fdp_nci_i2c_read() when processing a packet with a declared length below the minimum frame size. An attacker with physical access can provide a packet with a declared length below the minimum frame size to cause a denial of service.
Affected software
Linux kernel
How to mitigate CVE-2026-80802
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/0d723090645b82c1cb27cfd7ebf81f0e7c96bcae
- https://git.kernel.org/stable/c/1aa3fc769b0c45bd19f8dab1697084c2b3f6d706
- https://git.kernel.org/stable/c/1fc32327b927a6e2cde086f82575c29880844228
- https://git.kernel.org/stable/c/7ad21dcfeb5181af0c3ee2608808c0c0a5283aa1
- https://git.kernel.org/stable/c/8d2c243b79854628ff076c38748c020042f02f57
- https://git.kernel.org/stable/c/d9498ab9a78cb63d78dbe4f221d8cc6c91f285ee
- https://git.kernel.org/stable/c/db7e464b350969c6ea8340de00d9796e5fd5123b
- https://git.kernel.org/stable/c/e5eec121f2c3bc4c7022613bedd9121a8aa4c949
- https://git.kernel.org/stable/c/fc3c2bd5b1ec6c7cbc8a50e32d9bcec114f25463