---
id: "CVE-2026-98481"
kind: "vulnerability"
aliases: ["CVE-2026-98481"]
title: "Linux kernel NFC port100 driver reads past USB buffer on bad frames"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "nfc", "runtime", "self-hosted", "usb"]
not_affected_if: ["module-not-loaded", "no-nfc-hardware"]
published_at: "2026-10-18T16:16:58+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98481", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel NFC port100 driver reads past USB buffer on bad frames

The Linux kernel's port100 NFC driver trusts a 16-bit length field supplied by the USB device without checking it against the bytes actually received. A malicious or faulty device can make the kernel read memory beyond the transfer buffer, which can crash the system or leak kernel memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel with `uname -r` and look for the port100 driver with `lsmod | grep port100` or `grep -r port100 /lib/modules/$(uname -r)`
- Check whether the source tree includes the fix by looking for a length check before port100_rx_frame_is_valid() in drivers/nfc/port100.c
- Confirm whether the port100 module is loadable at all with `modprobe -n port100`

## Fix

- Update the Linux kernel to a release that includes the upstream nfc: port100 fix (fixed version unknown from sources)
- If the kernel cannot be updated soon, blacklist the module with `echo 'blacklist port100' > /etc/modprobe.d/port100.conf` and reboot, since the driver is only needed for port100 NFC readers

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98481

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

nfc: port100: reject frames whose declared length exceeds the received data

port100_recv_response() passes the URB transfer buffer to
port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen)
bytes of frame->data. datalen is a 16-bit field supplied by the device
and is never checked against the number of bytes actually received
(urb->actual_length), so a device reporting a datalen larger than the
received frame makes port100_data_checksum() read out of bounds past the
transfer buffer.

Reject a response whose declared frame size does not fit the received
length before validating it.

Found by 0sec (https://0sec.ai) using automated source analysis; the
missing bound is evident from source. Compile-tested.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_