CVE-2026-98482 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

CVE-2026-98482

The Linux kernel contains a vulnerability in the nfc: llcp component within the nfc_llcp_recv_hdlc() function. The issue occurs because the function reads the sequence byte (skb->data[2]) via nfc_llcp_ns()/nfc_llcp_nr() without a prior length check. Since the receive path only guarantees a two...

EUVD-2026-103722

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

CVE-2026-31629: Improper Locking

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCPCLOSED checks In nfcllcprecvhdlc and nfcllcprecvdisc, when the socket state is LLCPCLOSED, the code correctly calls releasesock and nfcllcpsockput but fails to return. Execution falls throu...