An unauthenticated attacker within physical proximity can exploit an out-of-bounds read vulnerability in the Linux kernel NFC stack to cause system instability or information leakage.

This is an out-of-bounds read flaw in the nfc_llcp_recv_snl function, where insufficient validation of SNL TLV lengths allows an unauthenticated attacker to supply malformed data that causes memory access errors.

Successful exploitation allows an adjacent attacker to crash the kernel, resulting in a denial of service for systems utilizing NFC features. While the CVSS score of 7.1 indicates a high severity, the requirement for physical proximity (adjacent network) limits the attack surface; however, impacted devices could be rendered unresponsive or forced into a reboot loop, causing significant operational downtime in environments relying on NFC connectivity.

Immediate Action: Apply the latest kernel security updates provided by your distribution vendor, specifically ensuring versions 5.10.270, 5.15.221, 6.1.188, or 6.6.157 (or later) are deployed.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected NFC driver restarts that may indicate attempted exploitation of the LLCP stack.

Compensating Controls: If patching is not immediately feasible, disable the NFC subsystem or blacklist the relevant kernel modules (such as nfc or llcp) on systems where NFC functionality is not strictly required.

Public Exploit Available: Unknown

Given the potential for system-wide instability, organizations should prioritize patching Linux-based systems that utilize NFC hardware. Administrators are advised to verify their kernel versions against the provided fixed releases and apply updates through their standard patch management lifecycle to mitigate this high-severity risk.