CVE-2026-31622

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31622
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31622.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-31622
Downstream
Related
Published
2026-04-24T14:42:39.916Z
Modified
2026-06-04T09:14:18.005062934Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
Details

In the Linux kernel, the following vulnerability has been resolved:

NFC: digital: Bounds check NFC-A cascade depth in SDD response handler

The NFC-A anti-collision cascade in digitalinrecvsddres() appends 3 or 4 bytes to target->nfcid1 on each round, but the number of cascade rounds is controlled entirely by the peer device. The peer sets the cascade tag in the SDDRES (deciding 3 vs 4 bytes) and the cascade-incomplete bit in the SELRES (deciding whether another round follows).

ISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is sized accordingly (NFCNFCID1MAXSIZE = 10), but nothing in the driver actually enforces this. This means a malicious peer can keep the cascade running, writing past the heap-allocated nfc_target with each round.

Fix this by rejecting the response when the accumulated UID would exceed the buffer.

Commit e329e71013c9 ("NFC: nci: Bounds check struct nfc_target arrays") fixed similar missing checks against the same field on the NCI path.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31622.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2c66daecc4092e6049673c281b2e6f0d5e59a94c
Fixed
9ba6bb09e00b922d902f684f575779e5433fe6e3
Fixed
f83b399aa05a0712e3b1569a30d3d90b3533d2ef
Fixed
20663102c14566e900e1d2f679e30b7f1694f387
Fixed
2819f34e08bdffb6f06a51c67948ec5737fb166a
Fixed
1bec5698b55aa2be5c3b983dba657c01d0fd3dbc
Fixed
5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1
Fixed
8d9d9bf3565271ca7ab9c716a94e87296177e7ba
Fixed
cc024a3de265ef6c58957f4990eccb9f806208cb
Fixed
46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31622.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.13.0
Fixed
5.10.258
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.209
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.175
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.136
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.83
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.24
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.19.14
Type
ECOSYSTEM
Events
Introduced
6.20.0
Fixed
7.0.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31622.json"