Heap Out-of-Bounds Write in Linux kernel NFC digital_in_recv_sdd_res()

CVE-2026-31622 is a Linux kernel NFC subsystem vulnerability in the NFC digital stack, specifically in the NFC-A anti-collision SDD response handler digital_in_recv_sdd_res(). During NFC-A anti-collision, the handler appends 3 or 4 bytes to target->nfcid1 on each cascade round. The peer device controls both whether 3 or 4 bytes are appended via the cascade tag in SDD_RES and whether additional cascade rounds continue via the cascade-incomplete bit in SEL_RES. Although ISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is sized accordingly (NFC_NFCID1_MAXSIZE = 10), the vulnerable code did not enforce this limit. As a result, a malicious NFC peer could force excessive cascade rounds and cause writes past the end of the heap-allocated struct nfc_target buffer, resulting in a heap-based out-of-bounds write. The fix adds bounds checking and rejects responses when the accumulated UID would exceed the target->nfcid1 buffer.