---
id: "CVE-2026-98482"
kind: "vulnerability"
aliases: ["CVE-2026-98482"]
title: "Linux kernel: truncated NFC LLCP frames read uninitialised memory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "nfc", "runtime"]
not_affected_if: ["no-nfc-hardware"]
published_at: "2026-10-18T16:16:58+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98482", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: truncated NFC LLCP frames read uninitialised memory

A two-byte I, RR or RNR LLCP PDU on the Linux NFC stack makes the kernel read one byte of uninitialised skb tailroom as a sequence number. The fix guards the read with pskb_may_pull() and drops truncated PDUs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98482

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

nfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via
nfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path
only guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it
with pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs
-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb
tailroom. The byte becomes N(R)/N(S); a peer can already set those with
a well-formed PDU, so this is acting on uninitialised memory, not new
peer control.

Guard the read with pskb_may_pull(), as commit 95674f506c63 ("nfc: llcp:
reject PDUs shorter than the LLCP header") did for the two-byte header,
so the sequence byte is present and linear before it is read. RR and RNR
PDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is
longer, so no valid frame is rejected; a truncated PDU is malformed, so
return without a DM reply.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_