The Linux kernel's nfc_llcp_recv_snl() function parsed SNL TLV lists using offsets and lengths derived from skb->len without properly bounding reads to the actual skb data. This led to three issues: underflow of tlv_len for short frames, reading TLV headers without verifying sufficient bytes remain, and out-of-bounds reads when declared TLV lengths exceeded buffer size. Specifically, SDREQ and SDRES TLVs lacked adequate length checks, causing size_t underflow and out-of-bounds memory access. The vulnerability could be exploited by a nearby NFC device without authentication since LLCP link activation is automatic after NFC-DEP. The fix involved walking the TLV list by pointer bounded by skb_tail_pointer(), validating each TLV's declared length, and adding explicit length checks for SDREQ and SDRES TLVs.

An unauthenticated nearby attacker with NFC capability could trigger out-of-bounds reads in the kernel memory, potentially causing a denial of service (kernel crash). The CVSS score of 7.1 reflects a high severity with local network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality impact with high availability impact.

A fix is available that bounds TLV parsing to the actual skb data and adds explicit length checks for TLV types. Users should apply the official Linux kernel patches that address this vulnerability. Since this is not a cloud service, remediation depends on updating affected Linux kernel versions. Patch status is not explicitly stated in the input data; check the vendor advisory for current remediation guidance.