CVE-2026-98584

The Linux kernel contains a potential stack information leak within the net/sched component. The em_text_dump() function allocates struct tcf_em_text on the stack without zeroing it. Because strscpy() was used instead of strncpy(), the remaining bytes of the structure remain uninitialized. These ...

CVE-2026-98583

The Linux kernel contains a vulnerability in the nfc: nfcmrvl component regarding the firmware download receive path. The root cause is that the system removes the NCI data header and reads the helper command before validating the remaining packet length. This allows a short frame to reach the da...

CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

EUVD-2026-103628

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98582 nfc: st21nfca: validate received frame size

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

EUVD-2026-103627

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

CVE-2026-98582 nfc: st21nfca: validate received frame size

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

CVE-2026-98582

The Linux kernel contains a vulnerability in the nfc: st21nfca component. The function st21nfca_hci_i2c_repack() incorrectly trims a received frame at its EOF marker before removing byte stuffing, leading to an out-of-bounds read. Specifically, a malformed frame can cause the unstuffing loop to r...

CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581

The Linux kernel contains a vulnerability in the nfc: llcp component specifically within the nfc_llcp_recv_dm() function. The root cause is a list corruption and refcount desync occurring when handling DM(NOBOUND)/DM(REJ) for sockets still linked on local->connecting_sockets. Because the funct...

EUVD-2026-103626

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98580 nfc: llcp: Fix race condition in accept_queue lifecycle

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...

EUVD-2026-103625

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...

CVE-2026-98580

The Linux kernel contains a race condition in the nfc: llcp component related to the accept_queue lifecycle. Specifically, in nfc_llcp_socket_release(), the use of bh_lock_sock() fails to synchronize against the process-context lock_sock() held by nfc_llcp_accept_dequeue() during an accept operat...

CVE-2026-98580 nfc: llcp: Fix race condition in accept_queue lifecycle

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...

CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

EUVD-2026-103624

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...