CVE-2026-63915

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfc: hci: fix out-of-bounds read in HCP header parsing<br /> <br /> Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read<br /> packet-&gt;header from skb-&gt;data at function entry without first checking<br /> that the buffer holds at least one byte. A malicious NFC peer can send<br /> a 0-byte HCP frame that passes through the SHDLC layer and reaches<br /> these functions, causing an out-of-bounds heap read of packet-&gt;header.<br /> The same 0-byte frame, if queued as a non-final fragment, also causes<br /> the reassembly loop to underflow msg_len to UINT_MAX, triggering<br /> skb_over_panic() when the reassembled skb is written.<br /> <br /> Fix this by adding a pskb_may_pull() check at the entry of each<br /> function before packet-&gt;header is first accessed. The existing<br /> pskb_may_pull() checks before the reassembled hcp_skb is cast to<br /> struct hcp_packet remain in place to guard the 2-byte HCP message<br /> header.