{"id":"CVE-2026-98480","kind":"vulnerability","aliases":["CVE-2026-98480"],"related":[],"title":"Linux kernel NFC trf7970a driver leaks power on startup error","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: trf7970a: power down on startup RX gain failure\n\ntrf7970a_startup() powers up the device before applying the optional RX\ngain reduction. If the register read or write fails, it returns without\nundoing that power-up. Probe's unwind only drops the separate regulator\nreferences acquired by probe, leaving the additional VIN enable from\nstartup unbalanced. The system resume caller also has no power-down on\nthis error.\n\nCall trf7970a_power_down() before returning the RX gain error to deassert\nthe enable GPIOs, release the startup VIN reference and restore the\npowered-off state. Runtime PM has not been enabled yet, so the full\nshutdown helper is not appropriate here. Preserve the original SPI error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.","summary":"In the Linux kernel's trf7970a NFC driver, a failed RX gain register access during startup returns without powering the device back down, leaving the VIN enable unbalanced. The sources describe a resource and power-state imbalance found by static analysis, not a confirmed remote compromise.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","linux-kernel","nfc","runtime"],"not_affected_if":["driver-not-loaded","no-trf7970a-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'nfc: trf7970a: power down on startup RX gain failure' (version unknown from the sources)","status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:52+00:00","updated_at":"2026-10-25T05:25:52+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:25:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'nfc: trf7970a: power down on startup RX gain failure' (version unknown from the sources)","reach":"local","title":"Linux kernel NFC trf7970a driver leaks power on startup error","impact":"low","summary":"In the Linux kernel's trf7970a NFC driver, a failed RX gain register access during startup returns without powering the device back down, leaving the VIN enable unbalanced. The sources describe a resource and power-state imbalance found by static analysis, not a confirmed remote compromise.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","nfc","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Device power state stays unbalanced after a failed startup, causing resource leak","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-trf7970a-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the trf7970a NFC reader driver, typically embedded boards or hardware using that TI NFC chip with an SPI connection. Systems without this NFC hardware or driver are not affected. The sources do not say which kernel versions are impacted.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000592,"input_tokens":3503,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98480':13A,16A 'access':36B 'acquir':126C 'addit':131C 'also':141C 'analysi':64B,207C 'appli':96C 'appropri':191C 'back':44B 'call':150C 'caller':140C 'code':212C 'compromis':69B 'confirm':67B 'cve':11A,14A 'deassert':161C 'describ':53B 'devic':43B,94C 'driver':5A,30B 'drop':121C 'embed':17B 'enabl':49B,133C,163C,182C 'error':10A,149C,159C,197C 'fail':32B,108C 'failur':88C 'follow':75C 'found':61B 'full':186C 'gain':34B,87C,100C,158C 'gpio':164C 'helper':188C 'identifi':201C 'imbal':60B 'issu':199C 'kernel':2A,20B,26B,73C,211C 'leak':6A 'leav':46B,129C 'linux':1A,19B,25B,72C 'linux-kernel':18B 'nfc':3A,21B,29B,80C 'ongo':204C 'option':98C 'origin':195C 'pm':178C 'power':7A,41B,58B,82C,91C,115C,145C,152C,174C 'power-down':144C 'power-st':57B 'power-up':114C 'powered-off':173C 'preserv':193C 'probe':117C,128C 'read':105C 'reduct':101C 'refer':125C,169C 'regist':35B,104C 'regul':124C 'releas':165C 'remot':68B 'research':208C 'resolv':79C 'resourc':55B 'restor':171C 'resum':139C 'return':39B,110C,155C 'review':210C 'runtim':22B,177C 'rx':33B,86C,99C,157C 'separ':123C 'shutdown':187C 'sourc':52B 'spi':196C 'startup':9A,38B,85C,90C,135C,167C 'state':59B,176C 'static':63B,206C 'static-analysi':205C 'system':138C 'trf7970a':4A,28B,81C,89C,151C 'unbalanc':50B,136C 'undo':112C 'unwind':119C 'vin':48B,132C,168C 'vulner':76C 'without':40B,111C 'write':107C 'yet':183C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the trf7970a NFC reader driver, typically embedded boards or hardware using that TI NFC chip with an SPI connection. Systems without this NFC hardware or driver are not affected. The sources do not say which kernel versions are impacted.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98480","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-19T10:18:59+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}