--- x/net/nfc/nci/core.c
+++ y/net/nfc/nci/core.c
@@ -886,6 +886,9 @@ static int nci_activate_target(struct nf
 
 	pr_debug("target_idx %d, protocol 0x%x\n", target->idx, protocol);
 
+	if (protocol == 0 || NFC_PROTO_MAX <= protocol)
+		return -EINVAL;
+
 	if ((atomic_read(&ndev->state) != NCI_W4_HOST_SELECT) &&
 	    (atomic_read(&ndev->state) != NCI_POLL_ACTIVE)) {
 		pr_err("there is no available target to activate\n");