---
id: "CVE-2026-98480"
kind: "vulnerability"
aliases: ["CVE-2026-98480"]
title: "Linux kernel NFC trf7970a driver leaks power on startup error"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "linux-kernel", "nfc", "runtime"]
not_affected_if: ["driver-not-loaded", "no-trf7970a-hardware"]
published_at: "2026-10-18T16:16:58+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98480", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel NFC trf7970a driver leaks power on startup error

In the Linux kernel's trf7970a NFC driver, a failed RX gain register access during startup returns without powering the device back down, leaving the VIN enable unbalanced. The sources describe a resource and power-state imbalance found by static analysis, not a confirmed remote compromise.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the upstream commit 'nfc: trf7970a: power down on startup RX gain failure' (version unknown from the sources)

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98480

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

nfc: trf7970a: power down on startup RX gain failure

trf7970a_startup() powers up the device before applying the optional RX
gain reduction. If the register read or write fails, it returns without
undoing that power-up. Probe's unwind only drops the separate regulator
references acquired by probe, leaving the additional VIN enable from
startup unbalanced. The system resume caller also has no power-down on
this error.

Call trf7970a_power_down() before returning the RX gain error to deassert
the enable GPIOs, release the startup VIN reference and restore the
powered-off state. Runtime PM has not been enabled yet, so the full
shutdown helper is not appropriate here. Preserve the original SPI error.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_