CVE-2026-98582
Received Received - Intake

Buffer Overflow in Linux Kernel NFC ST21NFCA Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it unconditionally reads the byte after an escape marker. A malformed frame can place EOF immediately after the start marker or can end its data portion with an escape marker. The former leaves too few bytes for check_crc(), while the latter makes the unstuffing loop read past the current skb length. Require the minimum framing bytes both before and after unstuffing. Use separate input and output cursors while removing byte stuffing, and reject an escape marker without its encoded byte. This keeps malformed frames within the received frame boundary before CRC processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98582
EUVD
EUVD-2026-103627

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1
Linux Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1
Linux Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1
Linux Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1
Linux Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1
Linux Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1
Linux Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1
Linux Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1
Linux Linux 3.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of NFC frames by the st21nfca driver. A malformed frame can cause the driver to read past the allocated memory when processing byte stuffing and CRC checks, potentially leading to memory corruption or crashes.

Detection Guidance

This vulnerability affects the Linux kernel's NFC subsystem, specifically the st21nfca driver. Detection requires checking if your system uses a vulnerable kernel version with the st21nfca module loaded. Inspect kernel logs for malformed NFC frames or crashes related to st21nfca_hci_i2c_repack. Use commands like 'dmesg | grep st21nfca' or 'lsmod | grep st21nfca' to check module status.

Impact Analysis

If exploited, this flaw could allow an attacker to crash the system or execute arbitrary code with kernel privileges. It primarily affects systems using NFC devices with the st21nfca driver, potentially disrupting services or enabling further attacks.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-98582. If immediate patching is not possible, disable the st21nfca module by running 'modprobe -r st21nfca' and blacklist it in /etc/modprobe.d/. Alternatively, restrict NFC device usage until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart