CVE-2026-98481
Received Received - Intake

Buffer Overflow in Linux Kernel NFC Port100 Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer. Reject a response whose declared frame size does not fit the received length before validating it. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98481
EUVD
EUVD-2026-103721

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06
Linux Linux 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06
Linux Linux 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06
Linux Linux 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06
Linux Linux 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06
Linux Linux 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06
Linux Linux 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06
Linux Linux 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06
Linux Linux 3.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's NFC (Near Field Communication) port100 driver. It involves a buffer overflow risk where a malicious device can report a frame length larger than the actual received data. The driver fails to validate the declared frame size against the received data length before processing, leading to out-of-bounds memory access during checksum validation.

Detection Guidance

This vulnerability involves out-of-bounds reads in the Linux kernel's NFC port100 driver. Detection requires checking for kernel logs or crashes related to NFC device interactions. Monitor dmesg or syslog for errors like 'port100: invalid frame size' or memory corruption warnings. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker with physical proximity to exploit the NFC device to cause a denial of service (system crash) or potentially execute arbitrary code on the affected system. It may also lead to unauthorized data access if the system processes malformed NFC frames.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the issue. Disable or unload the NFC port100 driver if not in use. Monitor vendor advisories for updates. No specific mitigation commands are provided in the context.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98481. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart