CVE-2026-98575

Received Received - Intake

Out-of-Bounds Read in Linux Kernel NFC PN533 Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() frame->ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame->data[]. A malicious or malfunctioning device can set this field to an arbitrary value, causing the driver to read far outside the received buffer. Bound ccid.datalen against the maximum possible ACR122 frame size before using it. This replaces the existing datalen == 0 check, since datalen < 2 already covers that case and additionally rejects datalen == 1, which would still underflow the "datalen - 2" offset used below.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98575

EUVD

EUVD-2026-103620

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9815c7cf22daceabfb919ddcd6f2c80e049c1fbc
Linux	Linux	9815c7cf22daceabfb919ddcd6f2c80e049c1fbc
Linux	Linux	9815c7cf22daceabfb919ddcd6f2c80e049c1fbc
Linux	Linux	9815c7cf22daceabfb919ddcd6f2c80e049c1fbc
Linux	Linux	9815c7cf22daceabfb919ddcd6f2c80e049c1fbc
Linux	Linux	9815c7cf22daceabfb919ddcd6f2c80e049c1fbc
Linux	Linux	9815c7cf22daceabfb919ddcd6f2c80e049c1fbc
Linux	Linux	9815c7cf22daceabfb919ddcd6f2c80e049c1fbc
Linux	Linux	4.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds (OOB) read in the Linux kernel's NFC driver for PN533 devices. It occurs when the driver reads the frame->ccid.datalen value directly from a USB response without validation. A malicious or faulty device can set this value to an arbitrary number, causing the driver to access memory outside the received buffer when processing the frame.

Detection Guidance

This vulnerability involves an out-of-bounds read in the Linux kernel's NFC pn533 driver. Detection requires checking if your system uses a vulnerable kernel version with the pn533 driver. Inspect kernel logs for errors related to NFC or pn533. Use commands like 'dmesg | grep pn533' or 'lsmod | grep pn533' to check for driver usage.

Impact Analysis

This flaw could allow an attacker with physical or logical access to a vulnerable system to cause a denial of service (system crash) or potentially leak sensitive kernel memory. Systems using NFC devices with the affected PN533 driver are at risk if compromised devices are connected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level buffer overflow issue in the Linux kernel's NFC driver. Compliance impacts would only occur if exploitation led to unauthorized data access or system compromise, which is not specified in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate kernel update is not possible, disable the pn533 NFC driver by blacklisting it or removing the module. Monitor for any suspicious USB device interactions.

Hi! I’m here to help you understand CVE-2026-98575. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70