Skip to main content

Linux Kernel CVE-2026-63915

| EUVDEUVD-2026-45688 HIGH
2026-07-19 Linux GHSA-jmh7-f679-ghx4
Buffer Overflow Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.1 HIGH

NFC proximity gives AV:A; no auth/interaction (PR:N/UI:N); primitives are a limited OOB read (C:L) and kernel panic (A:H), with no evidence of integrity/code-exec impact (I:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:16 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:55 cve.org
HIGH 8.8
CVE Published
Jul 19, 2026 - 14:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: fix out-of-bounds read in HCP header parsing

Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read packet->header from skb->data at function entry without first checking that the buffer holds at least one byte. A malicious NFC peer can send a 0-byte HCP frame that passes through the SHDLC layer and reaches these functions, causing an out-of-bounds heap read of packet->header. The same 0-byte frame, if queued as a non-final fragment, also causes the reassembly loop to underflow msg_len to UINT_MAX, triggering skb_over_panic() when the reassembled skb is written.

Fix this by adding a pskb_may_pull() check at the entry of each function before packet->header is first accessed. The existing pskb_may_pull() checks before the reassembled hcp_skb is cast to struct hcp_packet remain in place to guard the 2-byte HCP message header.

AnalysisAI

Out-of-bounds heap read and remote kernel panic in the Linux kernel NFC HCI/HCP stack (nfc_hci_recv_from_llc() and nci_hci_data_received_cb()) let an adjacent malicious NFC peer send a crafted 0-byte HCP frame that reaches these handlers before any length check, reading packet->header past the buffer and, when the frame is queued as a non-final fragment, underflowing msg_len to UINT_MAX and forcing skb_over_panic(). No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV, so this is a proximity-limited DoS/info-leak affecting any NFC-enabled Linux device, fixed by the maintainers. Exploitation requires NFC radio range and an active NFC/HCI stack, which sharply narrows the real attack surface versus the raw 8.8 score.

Technical ContextAI

The bug lives in the kernel's NFC Host Controller Interface (HCI) and its Host Controller Protocol (HCP) parsing, which sits above the SHDLC/LLC link layer used by NFC controllers (NCI and pn544-style HCI drivers). Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() dereference packet->header directly from skb->data on entry without calling pskb_may_pull() to guarantee at least one byte is present, so a 0-byte frame that passes SHDLC yields an out-of-bounds read of the HCP header (a CWE-125 out-of-bounds read; the reassembly underflow is effectively a CWE-191 integer underflow leading to a CWE-787 out-of-bounds write via skb_over_panic). The fix adds a 1-byte pskb_may_pull() guard at each entry point, complementing the pre-existing 2-byte pull check that protects the later cast to struct hcp_packet. The linux:linux CPE is generic; the true affected component is the CONFIG_NFC_HCI/NCI code path, only compiled and active on kernels built with NFC support and running on hardware with an NFC controller.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 7.1, 6.18.35, 6.12.93, 6.6.143, 6.1.176, 5.15.210, or 5.10.259 (or later on each branch), or apply the corresponding stable commits listed at https://git.kernel.org/stable/ (e.g. 83b1362edc9d). Distribution users should install the vendor kernel update that references CVE-2026-63915 and reboot. Where immediate patching is not possible, the most effective compensating control is to disable or unload the NFC stack on systems that do not require it - e.g. blacklist the NFC controller driver and nfc core modules (modprobe blacklist / rmmod) or build without CONFIG_NFC; the trade-off is complete loss of NFC functionality (contactless payment, tag reading, pairing), which is acceptable on servers and most endpoints but not on devices whose core function is NFC. As a physical control, exploitation requires radio proximity, so restricting untrusted access to the immediate vicinity of NFC-enabled devices reduces exposure.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63915 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy