Live › vulnerability › CVE-2026-98481
Go to dashboardThe Linux kernel's port100 NFC driver trusts a 16-bit length field supplied by the USB device without checking it against the bytes actually received. A malicious or faulty device can make the kernel read memory beyond the transfer buffer, which can crash the system or leak kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load the port100 NFC driver are exposed, which means machines with a Sony NFC port100-based USB reader plugged in or the module otherwise loaded. Servers, containers and desktops without NFC hardware usually have the module unloaded and can skip it. The sources do not say whether an attacker needs physical access to plug in a malicious USB device.
No product ranges from the sources yet.
uname -r and look for the port100 driver with lsmod | grep port100 or grep -r port100 /lib/modules/$(uname -r)modprobe -n port100echo 'blacklist port100' > /etc/modprobe.d/port100.conf and reboot, since the driver is only needed for port100 NFC readersEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nfc: port100: reject frames whose declared length exceeds the received data
port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer.
Reject a response whose declared frame size does not fit the received length before validating it.
Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.
This page as .md · .json · in your agent: get_signal("CVE-2026-98481")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.