In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: bound SNL TLV parsing to the skb and add length checks
nfc_llcp_recv_snl() walked the SNL TLV list using a u16 offset/length
pair derived from skb->len, without bounding reads to the actual skb
data. Three problems followed:
– For a short frame (skb->len = 1) and SDRES (exactly 2).
Found by 0sec automated security-research tooling (https://0sec.ai).
