The vulnerability in the Linux kernel NFC HCI code arises because two functions read the packet header from skb->data without confirming that the buffer contains at least one byte. A malicious NFC device can send a zero-length HCP frame that bypasses the SHDLC layer and causes an out-of-bounds heap read. Additionally, if such a frame is queued as a non-final fragment, it causes an underflow in the message length counter, leading to skb_over_panic() during reassembly. The fix involves adding pskb_may_pull() checks at the entry of these functions to ensure sufficient buffer length before accessing the header, while retaining existing checks for the 2-byte HCP message header.

A malicious NFC peer can exploit this vulnerability to cause out-of-bounds heap reads and trigger kernel panic conditions (skb_over_panic) by sending specially crafted zero-byte HCP frames. This could lead to denial of service via kernel crashes. There is no information about code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel by adding pskb_may_pull() checks before accessing packet headers in the affected NFC HCI functions. Users and administrators should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level issue, updating to a patched kernel version is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the exact fixed versions and update accordingly.