Linux Kernel NFC NCI Pipe Variable Bounds Checking Vulnerability

A vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem has been addressed. The issue arose in the NCI (NFC Controller Interface) component, specifically within the nci_hci_create_pipe() function. The vulnerability was caused by inadequate bounds checking of the 'pipe' variable, which is an 8-bit unsigned integer received from the network. If the value exceeded 127, it could lead to memory corruption in the calling function, nci_hci_connect_gate().

Impact

Exploitation of this vulnerability could result in memory corruption, potentially leading to arbitrary code execution or causing a system crash.