digital_in_recv_sensf_res() copies resp->len bytes from a remote NFC-F device response into target.sensf_res without checking that the length fits in the 18-byte destination buffer (NFC_SENSF_RES_MAXSIZE). A nearby malicious NFC-F device can send an oversized SENSF_RES response to overflow the stack-local struct nfc_target, potentially overwriting saved registers and the return address. Fix by clamping the copy length to NFC_SENSF_RES_MAXSIZE. Found by pwnkit (https://github.com/0sec-labs/pwnkit), an automated kernel source review tool by 0sec (https://0sec.ai). Signed-off-by: Doruk Tan Ozturk --- net/nfc/digital_technology.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c --- a/net/nfc/digital_technology.c +++ b/net/nfc/digital_technology.c @@ -778,6 +778,8 @@ static void digital_in_recv_sensf_res(struct nfc_digital_dev *ddev, sensf_res = resp->data; + if (resp->len > NFC_SENSF_RES_MAXSIZE) + resp->len = NFC_SENSF_RES_MAXSIZE; memcpy(target.sensf_res, sensf_res, resp->len);