{"id":"CVE-2026-98481","kind":"vulnerability","aliases":["CVE-2026-98481"],"related":[],"title":"Linux kernel NFC port100 driver reads past USB buffer on bad frames","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: port100: reject frames whose declared length exceeds the received data\n\nport100_recv_response() passes the URB transfer buffer to\nport100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen)\nbytes of frame->data. datalen is a 16-bit field supplied by the device\nand is never checked against the number of bytes actually received\n(urb->actual_length), so a device reporting a datalen larger than the\nreceived frame makes port100_data_checksum() read out of bounds past the\ntransfer buffer.\n\nReject a response whose declared frame size does not fit the received\nlength before validating it.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing bound is evident from source. Compile-tested.","summary":"The Linux kernel's port100 NFC driver trusts a 16-bit length field supplied by the USB device without checking it against the bytes actually received. A malicious or faulty device can make the kernel read memory beyond the transfer buffer, which can crash the system or leak kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","nfc","runtime","self-hosted","usb"],"not_affected_if":["module-not-loaded","no-nfc-hardware"],"how_to_check":"- Check the running kernel with `uname -r` and look for the port100 driver with `lsmod | grep port100` or `grep -r port100 /lib/modules/$(uname -r)`\n- Check whether the source tree includes the fix by looking for a length check before port100_rx_frame_is_valid() in drivers/nfc/port100.c\n- Confirm whether the port100 module is loadable at all with `modprobe -n port100`","fix":"- Update the Linux kernel to a release that includes the upstream nfc: port100 fix (fixed version unknown from sources)\n- If the kernel cannot be updated soon, blacklist the module with `echo 'blacklist port100' > /etc/modprobe.d/port100.conf` and reboot, since the driver is only needed for port100 NFC readers","status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:53+00:00","updated_at":"2026-10-25T05:25:53+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:25:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream nfc: port100 fix (fixed version unknown from sources)\n- If the kernel cannot be updated soon, blacklist the module with `echo 'blacklist port100' > /etc/modprobe.d/port100.conf` and reboot, since the driver is only needed for port100 NFC readers","reach":"local","title":"Linux kernel NFC port100 driver reads past USB buffer on bad frames","impact":"medium","summary":"The Linux kernel's port100 NFC driver trusts a 16-bit length field supplied by the USB device without checking it against the bytes actually received. A malicious or faulty device can make the kernel read memory beyond the transfer buffer, which can crash the system or leak kernel memory.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","nfc","usb","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel reads out of bounds, possible crash or memory disclosure","analyst_note":"Find the upstream fixed kernel version and commit for the port100 length check in the kernel stable trees, and confirm whether an attacker needs physical USB access.","how_to_check":"- Check the running kernel with `uname -r` and look for the port100 driver with `lsmod | grep port100` or `grep -r port100 /lib/modules/$(uname -r)`\n- Check whether the source tree includes the fix by looking for a length check before port100_rx_frame_is_valid() in drivers/nfc/port100.c\n- Confirm whether the port100 module is loadable at all with `modprobe -n port100`","needs_analyst":true,"not_affected_if":["no-nfc-hardware","module-not-loaded"],"who_is_affected":"Only systems that load the port100 NFC driver are exposed, which means machines with a Sony NFC port100-based USB reader plugged in or the module otherwise loaded. Servers, containers and desktops without NFC hardware usually have the module unloaded and can skip it. The sources do not say whether an attacker needs physical access to plug in a malicious USB device.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000731,"input_tokens":3482,"output_tokens":766,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98481':15A,18A '0sec':189C '0sec.ai':190C '16':37B,127C 'actual':52B,143C,146C 'analysi':194C 'autom':192C 'bad':11A 'beyond':65B 'bit':38B,128C 'bound':166C,197C 'buffer':9A,68B,106C,170C 'byte':51B,120C,142C 'check':47B,137C 'checksum':114C,162C 'compil':203C 'compile-test':202C 'cpu':117C 'crash':71B 'cve':13A,16A 'data':98C,123C,161C 'datalen':119C,124C,153C 'declar':93C,175C 'devic':45B,58B,133C,150C 'driver':5A,34B 'evid':199C 'exceed':95C 'faulti':57B 'field':40B,129C 'fit':180C 'follow':83C 'found':187C 'frame':12A,91C,110C,118C,122C,158C,176C 'host':26B 'kernel':2A,21B,30B,62B,76B,81C 'larger':154C 'le16':115C 'leak':75B 'length':39B,94C,147C,183C 'linux':1A,20B,29B,80C 'linux-kernel':19B 'make':60B,159C 'malici':55B 'memori':64B,77B 'miss':196C 'never':136C 'nfc':3A,22B,33B,88C 'number':140C 'pass':102C 'past':7A,167C 'port100':4A,32B,89C,99C,108C,160C 'read':6A,63B,163C 'receiv':53B,97C,144C,157C,182C 'recv':100C 'reject':90C,171C 'report':151C 'resolv':87C 'respons':101C,173C 'runtim':23B 'rx':109C 'self':25B 'self-host':24B 'size':177C 'sourc':193C,201C 'suppli':41B,130C 'system':73B 'test':204C 'transfer':67B,105C,169C 'trust':35B 'urb':104C,145C 'usb':8A,27B,44B 'use':191C 'valid':112C,185C 'vulner':84C 'whose':92C,174C 'without':46B","nicknames":[],"mitigations":[],"who_affected":"Only systems that load the port100 NFC driver are exposed, which means machines with a Sony NFC port100-based USB reader plugged in or the module otherwise loaded. Servers, containers and desktops without NFC hardware usually have the module unloaded and can skip it. The sources do not say whether an attacker needs physical access to plug in a malicious USB device.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98481","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-19T10:18:59+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}