EUVD-2026-103626

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581

The Linux kernel contains a vulnerability in the nfc: llcp component specifically within the nfc_llcp_recv_dm() function. The root cause is a list corruption and refcount desync occurring when handling DM(NOBOUND)/DM(REJ) for sockets still linked on local->connecting_sockets. Because the funct...

CVE-2026-98580 nfc: llcp: Fix race condition in accept_queue lifecycle

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...

CVE-2026-98580

The Linux kernel contains a race condition in the nfc: llcp component related to the accept_queue lifecycle. Specifically, in nfc_llcp_socket_release(), the use of bh_lock_sock() fails to synchronize against the process-context lock_sock() held by nfc_llcp_accept_dequeue() during an accept operat...

CVE-2026-98580 nfc: llcp: Fix race condition in accept_queue lifecycle

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...

EUVD-2026-103625

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...

CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

EUVD-2026-103624

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98579

The Linux kernel contains a memory leak vulnerability in the nfc: llcp component. Specifically, the function nfc_genl_llc_sdreq() fails to free queued TLV nodes during three specific error paths: nested-attr parse failure , TLV alloc ENOMEM , and nfc_llcp_send_snl_sdreq() failure . The issue is r...

CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

EUVD-2026-103623

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

CVE-2026-98578

The Linux kernel contains a vulnerability in the nfc: st21nfca component involving the ISO15693 inventory helper . The root cause is that the helper removes a two-byte prefix without verifying its existence and subsequently accepts a one-byte remainder before reading data as the DSFID . To remedi...

CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

EUVD-2026-103622

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

CVE-2026-98577

The Linux kernel contains a vulnerability in the nfc_llcp_wks_sap() function, which allows for WKS SAP hijacking . The root cause is that the function compares only service_name_len bytes, leading to a prefix match where a short service name (e.g., "u") incorrectly matches longer WKS strings (e.g...

CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...