{"id":"CVE-2026-98482","kind":"vulnerability","aliases":["CVE-2026-98482"],"related":[],"title":"Linux kernel: truncated NFC LLCP frames read uninitialised memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()\n\nnfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via\nnfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path\nonly guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it\nwith pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs\n-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb\ntailroom. The byte becomes N(R)/N(S); a peer can already set those with\na well-formed PDU, so this is acting on uninitialised memory, not new\npeer control.\n\nGuard the read with pskb_may_pull(), as commit 95674f506c63 (\"nfc: llcp:\nreject PDUs shorter than the LLCP header\") did for the two-byte header,\nso the sequence byte is present and linear before it is read. RR and RNR\nPDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is\nlonger, so no valid frame is rejected; a truncated PDU is malformed, so\nreturn without a DM reply.","summary":"A two-byte I, RR or RNR LLCP PDU on the Linux NFC stack makes the kernel read one byte of uninitialised skb tailroom as a sequence number. The fix guards the read with pskb_may_pull() and drops truncated PDUs.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","nfc","runtime"],"not_affected_if":["no-nfc-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:48+00:00","updated_at":"2026-10-25T05:25:48+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:25:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: truncated NFC LLCP frames read uninitialised memory","impact":"low","summary":"A two-byte I, RR or RNR LLCP PDU on the Linux NFC stack makes the kernel read one byte of uninitialised skb tailroom as a sequence number. The fix guards the read with pskb_may_pull() and drops truncated PDUs.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","nfc"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel reads uninitialised memory; sequence numbers corrupted","analyst_note":"Confirm the affected kernel version range and the fixed stable releases from the NVD entry or kernel.org stable commit 95674f506c63 follow-up.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-nfc-hardware"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000557,"input_tokens":3691,"output_tokens":376,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-98482':12A,15A '/n':157C '/nfc_llcp_nr':99C '2':94C '95674f506c63':191C 'act':174C 'admit':129C 'agf':128C 'alreadi':162C 'becom':154C 'byte':24B,41B,91C,112C,132C,139C,147C,153C,206C,211C,231C 'check':103C,118C 'commit':190C 'control':181C 'cve':10A,13A 'data':93C 'dm':253C 'drop':60B,75C 'fix':51B 'follow':68C 'form':169C 'frame':6A,241C 'guarante':108C 'guard':52B,182C 'hdlc':83C,87C 'header':114C,200C,207C,226C 'i/rr/rnr':77C 'inner':133C 'kernel':2A,18B,38B,66C 'length':102C 'linear':215C 'linux':1A,17B,33B,65C 'linux-kernel':16B 'llcp':5A,29B,74C,81C,85C,97C,113C,116C,126C,193C,199C,225C,228C 'longer':237C 'make':36B 'malform':248C 'may':57B,122C,187C 'memori':9A,177C 'n':155C 'new':179C 'nfc':4A,19B,34B,73C,80C,84C,96C,115C,125C,192C 'ns':98C 'number':49B 'one':40B,146C 'path':106C 'pdu':30B,144C,170C,235C,246C 'pdus':62B,78C,134C,195C,223C 'peer':160C,180C 'present':213C 'pskb':56B,121C,186C 'pull':58B,123C,188C 'r':156C 'read':7A,39B,54B,88C,145C,184C,219C 'receiv':105C 'recv':82C,86C,117C,127C 'reject':194C,243C 'repli':254C 'resolv':72C 'return':250C 'rnr':28B,143C,222C 'rr':26B,141C,220C 'runtim':20B 'sequenc':48B,90C,210C,229C 'set':163C 'shorter':196C 'size':227C,230C 'skb':44B,92C,150C 'stack':35B 'tailroom':45B,151C 'truncat':3A,61B,76C,245C 'two':23B,111C,131C,138C,205C 'two-byt':22B,110C,130C,137C,204C 'uninitialis':8A,43B,149C,176C 'valid':240C 'via':95C 'vulner':69C 'well':168C 'well-form':167C 'without':251C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98482","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-19T10:18:59+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}