CVE-2026-98579
Received Received - Intake

Memory Leak in Linux Kernel NFC LLCP

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc ENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was already queued. Route them through a new free_list label, mirroring the SDRES path in the same file which already does this. Harmless on the success path too -- send_snl_sdreq() drains the list as it moves nodes, so it's already empty by the time free_list runs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98579
EUVD
EUVD-2026-103624

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux d9b8d8e19b073096d3609bbd60f82148d128b555
Linux Linux d9b8d8e19b073096d3609bbd60f82148d128b555
Linux Linux d9b8d8e19b073096d3609bbd60f82148d128b555
Linux Linux d9b8d8e19b073096d3609bbd60f82148d128b555
Linux Linux d9b8d8e19b073096d3609bbd60f82148d128b555
Linux Linux d9b8d8e19b073096d3609bbd60f82148d128b555
Linux Linux d9b8d8e19b073096d3609bbd60f82148d128b555
Linux Linux d9b8d8e19b073096d3609bbd60f82148d128b555
Linux Linux 3.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the NFC LLCP (Near Field Communication Logical Link Control Protocol) component. When processing nested netlink attributes, the function nfc_genl_llc_sdreq() builds a list of TLV (Type-Length-Value) nodes. However, three error paths fail to free the allocated memory for these nodes, leading to a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFC LLCP implementation and involves a memory leak during TLV list handling. Detection requires checking kernel logs for related errors or monitoring for unusual memory usage patterns in NFC-related processes. Commands like dmesg, journalctl -k, or checking /proc/meminfo for abnormal memory consumption may help identify issues.

Impact Analysis

The memory leak could cause the system to gradually consume more memory over time, potentially leading to performance degradation or system instability. It may also trigger out-of-memory conditions if the leak occurs frequently.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. Check your distribution's security updates or kernel release notes for the specific patch. If updating is not immediately possible, consider disabling NFC functionality temporarily if it is not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart