CVE-2026-31622: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31622 is a heap buffer overflow vulnerability in the Linux kernel's NFC digital driver, specifically in the digital_in_recv_sdd_res() SDD response handler for NFC-A anti-collision cascade processing. The flaw exists because the driver does not enforce the ISO 14443-3 limit of three cascade levels, allowing a malicious NFC peer device to trigger unbounded writes past the heap-allocated nfc_target structure. Affected Linux kernel versions span from 3.13 through 6.6.135, 6.7 through 6.12.82, 6.13 through 6.18.23, 6.19 through 6.19.13, and 7.0 through 7.0.0. It was published on April 24, 2026, with a CVSS v3.1 base score of 8.8 (High), assigned by kernel.org (GitHub Advisory, Feedly).

The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow). In digital_in_recv_sdd_res(), the NFC-A anti-collision cascade appends 3 or 4 bytes to target->nfcid1 per round, with the number of rounds entirely controlled by the peer device via the cascade tag in SDD_RES and the cascade-incomplete bit in SEL_RES. The target->nfcid1 buffer is sized to NFC_NFCID1_MAXSIZE = 10 bytes per the ISO 14443-3 standard, but the driver never validates that the accumulated UID length stays within this bound. A malicious NFC peer can therefore keep the cascade running indefinitely, writing past the heap-allocated nfc_target structure on each round. The fix rejects SDD responses when the accumulated UID would exceed the buffer, mirroring a similar fix applied to the NCI path in commit e329e71013c9 (GitHub Advisory, Feedly).

Successful exploitation causes heap memory corruption in the Linux kernel, with potential consequences including kernel panic (denial of service), disclosure of sensitive kernel memory contents, or arbitrary kernel code execution depending on heap layout and exploitation technique. Because the overflow occurs in kernel space, a successful exploit could grant an attacker full control of the affected system. The attack vector is adjacent network (NFC proximity), limiting the blast radius to devices within NFC range, but any Linux system with NFC digital protocol support enabled and an exposed NFC interface is at risk (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires physical NFC proximity (typically within ~10 cm) and a specially crafted malicious NFC peer device capable of manipulating SDD_RES and SEL_RES responses, which raises the bar for opportunistic attacks.

1. Identify a target: Locate a Linux system with NFC digital protocol support enabled (e.g., a smartphone, embedded device, or laptop with an NFC reader running a vulnerable kernel version between 3.13 and 6.6.135, 6.7–6.12.82, 6.13–6.18.23, 6.19–6.19.13, or 7.0.0).
2. Prepare a malicious NFC peer device: Use a programmable NFC device (e.g., a custom NFC emulator or modified NFC tag reader/writer) capable of crafting arbitrary SDD_RES and SEL_RES responses.
3. Initiate NFC-A anti-collision: Bring the malicious device within NFC range (~10 cm) of the target and trigger an NFC-A discovery/anti-collision sequence.
4. Craft malicious SDD_RES responses: In each SDD_RES, set the cascade tag to indicate 3 or 4 bytes of UID data, and set the cascade-incomplete bit in SEL_RES to force additional cascade rounds beyond the ISO 14443-3 limit of three levels.
5. Trigger heap overflow: Each additional cascade round appends 3–4 bytes to target->nfcid1 past the 10-byte NFC_NFCID1_MAXSIZE boundary, overwriting adjacent heap memory in the nfc_target structure.
6. Achieve exploitation objective: Depending on heap layout and kernel hardening measures, the overflow may cause a kernel panic (DoS), leak kernel memory, or enable arbitrary kernel code execution via heap exploitation techniques (Feedly, GitHub Advisory).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing NFC-related errors, unexpected kernel panics, or stack traces originating from digital_in_recv_sdd_res() or related NFC digital driver functions.
• Logs: Kernel oops or BUG messages referencing heap corruption in the NFC subsystem, particularly involving nfc_target or nfcid1 fields.
• Process/System Behavior: Unexpected system crashes or kernel panics on devices with active NFC interfaces, especially when in proximity to unknown NFC devices.
• Network/Physical: Repeated or anomalous NFC anti-collision sequences detected by NFC monitoring tools, particularly sequences exceeding three cascade levels (more than 10 bytes of UID data accumulated).
• File System: Unexpected kernel crash dump files (e.g., /var/crash/, kdump artifacts) generated during NFC device interaction.

Apply the upstream kernel patches corresponding to your kernel version: update to 6.6.136 or later (for 3.13–6.6.x), 6.12.83 or later (for 6.7–6.12.x), 6.18.24 or later (for 6.13–6.18.x), 6.19.14 or later (for 6.19.x), or 7.0.1 or later (for 7.0.x). Patch commits are available at git.kernel.org (e.g., 1bec5698b55a, 5a59bf70c38e, 8d9d9bf35652, cc024a3de265). As a workaround where patching is not immediately possible, disable NFC functionality via kernel module blacklisting (blacklist nfc_digital) or physical disablement of NFC hardware. Restrict NFC device usage to trusted environments and implement physical access controls to reduce proximity-based attack surface (GitHub Advisory, Red Hat Bugzilla, SUSE Advisory).

Red Hat tracked the issue via Bugzilla (bug #2461459) and SUSE issued multiple security update announcements (SUSE-SU-2026:2195-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1) addressing this CVE alongside other kernel vulnerabilities (Red Hat Bugzilla, SUSE Advisory). The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. No notable independent researcher commentary or significant social media discussion has been observed, consistent with the low EPSS score and absence of public exploit code.