CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98579

The Linux kernel contains a memory leak vulnerability in the nfc: llcp component. Specifically, the function nfc_genl_llc_sdreq() fails to free queued TLV nodes during three specific error paths: nested-attr parse failure , TLV alloc ENOMEM , and nfc_llcp_send_snl_sdreq() failure . The issue is r...

EUVD-2026-103624

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

EUVD-2026-103623

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

CVE-2026-98578

The Linux kernel contains a vulnerability in the nfc: st21nfca component involving the ISO15693 inventory helper . The root cause is that the helper removes a two-byte prefix without verifying its existence and subsequently accepts a one-byte remainder before reading data as the DSFID . To remedi...

CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

EUVD-2026-103622

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

CVE-2026-98577

The Linux kernel contains a vulnerability in the nfc_llcp_wks_sap() function, which allows for WKS SAP hijacking . The root cause is that the function compares only service_name_len bytes, leading to a prefix match where a short service name (e.g., "u") incorrectly matches longer WKS strings (e.g...

CVE-2026-98576

The Linux kernel contains a vulnerability in the nfc: llcp component where the functions nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-terminated strings to pr_debug() using the %s format specifier. Because these buffers are allocated via kmemdup() or sourced from netlink attrib...

EUVD-2026-103621

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

EUVD-2026-103620

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

CVE-2026-98575

The Linux kernel nfc driver for pn533 is vulnerable to an Out-of-Bounds (OOB) read in the pn533_acr122_is_rx_frame_valid() function. The root cause is that frame->ccid.datalen is read directly from a USB response frame and used as an unchecked index into the frame->data[] array. A malicious...

CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...