CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

EUVD-2026-103623

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

CVE-2026-98578

The Linux kernel contains a vulnerability in the nfc: st21nfca component involving the ISO15693 inventory helper . The root cause is that the helper removes a two-byte prefix without verifying its existence and subsequently accepts a one-byte remainder before reading data as the DSFID . To remedi...

CVE-2026-98576

The Linux kernel contains a vulnerability in the nfc: llcp component where the functions nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-terminated strings to pr_debug() using the %s format specifier. Because these buffers are allocated via kmemdup() or sourced from netlink attrib...

CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

EUVD-2026-103621

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

CVE-2026-98575

The Linux kernel nfc driver for pn533 is vulnerable to an Out-of-Bounds (OOB) read in the pn533_acr122_is_rx_frame_valid() function. The root cause is that frame->ccid.datalen is read directly from a USB response frame and used as an unchecked index into the frame->data[] array. A malicious...

EUVD-2026-103620

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

CVE-2026-98575

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

CVE-2026-98545 ata: libata-scsi: bound the ATA passthru sense descriptor writes

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

EUVD-2026-103590

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

CVE-2026-98545

The Linux kernel is vulnerable to an out-of-bounds read and write in the libata-scsi component. Specifically, when an ATA PASS-THROUGH command to an ATAPI device fails, the ata_scsi_set_passthru_sense_fields() function incorrectly trusts the additional length byte (sb[7] ) of the REQUEST SENSE re...

CVE-2026-98545 ata: libata-scsi: bound the ATA passthru sense descriptor writes

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98532

The Linux kernel is vulnerable to an out-of-bounds read and write in the IPv6 processing logic. The ipv6_find_hdr() function walks the extension header chain but fails to check if the skip amount exceeds the packet length (skb->len). This allows the function to return an offset pointing past t...