CVE-2026-98482

The Linux kernel contains a vulnerability in the nfc: llcp component within the nfc_llcp_recv_hdlc() function. The issue occurs because the function reads the sequence byte (skb->data[2]) via nfc_llcp_ns()/nfc_llcp_nr() without a prior length check. Since the receive path only guarantees a two...

CVE-2026-98482 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

EUVD-2026-103722

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

CVE-2026-98482 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

CVE-2026-98481 nfc: port100: reject frames whose declared length exceeds the received data

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

CVE-2026-98481

The Linux kernel contains an out-of-bounds read vulnerability in the nfc component, specifically within the port100 driver. The port100_recv_response() function passes a URB transfer buffer to port100_rx_frame_is_valid(), which calculates a checksum based on a 16-bit datalen field supplied by the...

CVE-2026-98481 nfc: port100: reject frames whose declared length exceeds the received data

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

EUVD-2026-103721

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

CVE-2026-98480 nfc: trf7970a: power down on startup RX gain failure

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970astartup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's unwi...

CVE-2026-98480

A vulnerability exists in the Linux kernel 's nfc: trf7970a driver. The trf7970a_startup() function powers up the device before applying optional RX gain reduction . If a register read or write fails, the function returns without undoing the power-up, leaving the VIN enable unbalanced because the...

CVE-2026-98480 nfc: trf7970a: power down on startup RX gain failure

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970astartup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's unwi...

EUVD-2026-103720

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970astartup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's unwi...

CVE-2026-98479 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

EUVD-2026-103719

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98479 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98479

The Linux kernel contains a vulnerability in the libiscsi_tcp component where iscsi_tcp_hdr_dissect() fails to verify the data direction of a Data-In PDU . Specifically, the function copies the PDU's data segment into a command's scatterlist without confirming if the command was a read operation....

EUVD-2026-103718

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

CVE-2026-98478 scsi: ufs: core: Keep internal commands dispatchable during error handling

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

CVE-2026-98478

The Linux kernel contains a vulnerability in the scsi: ufs: core component where internal commands could become non-dispatchable during error handling. Specifically, when ufshcd_err_handling_prepare() calls blk_mq_quiesce_tagset(), it marks all queues in the tagset as quiesced, including the pseu...

CVE-2026-98478 scsi: ufs: core: Keep internal commands dispatchable during error handling

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...