{"id":"CVE-2026-98483","kind":"vulnerability","aliases":["CVE-2026-98483"],"related":[],"title":"Linux kernel NFC: use-after-free when reading LLCP general bytes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix use-after-free in nfc_get_local_general_bytes\n\nCommit 6709d4b7bc2e (\"net: nfc: Fix use-after-free caused by\nnfc_llcp_find_local\") attempted to fix a use-after-free (UAF) issue by\ninvoking nfc_llcp_local_put(local) after accessing local->gb. However,\nif the reference count drops to zero, local is freed immediately,\nleading to a use-after-free when callers access the returned pointer.\nAlternative approaches using dynamic allocation (e.g. kmemdup) introduced\nmemory leaks because callers consistently treat the returned pointer as\nborrowed memory.\n\nFix this properly by refactoring nfc_llcp_general_bytes() and\nnfc_get_local_general_bytes() to accept a caller-provided output buffer\n(out_gb) and its maximum length (gb_max_len). The general bytes are\nsafely copied into out_gb before calling nfc_llcp_local_put(local),\nensuring safe lifetime management without ownership transfer complications.\n\nUpdate all callers across drivers (microread, pn533, pn544, st21nfca,\ndigital_dep, and nci) to provide their own destination buffers and pass\nthem to nfc_get_local_general_bytes().","summary":"The Linux kernel NFC subsystem returned a pointer to memory that could be freed before the caller used it, after an earlier fix dropped a reference too early. The fix copies the general bytes into a caller-provided buffer before the reference is released.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","nfc","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:48+00:00","updated_at":"2026-10-25T05:25:48+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:25:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel NFC: use-after-free when reading LLCP general bytes","impact":"medium","summary":"The Linux kernel NFC subsystem returned a pointer to memory that could be freed before the caller used it, after an earlier fix dropped a reference too early. The fix copies the general bytes into a caller-provided buffer before the reference is released.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","nfc"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; use-after-free in kernel memory","analyst_note":"Find the fixed kernel versions and the NVD/kernel.org commit to confirm affected releases and whether an unprivileged or remote NFC peer can trigger it.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000545,"input_tokens":3651,"output_tokens":360,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98483':15A,18A '6709d4b7bc2e':92C 'accept':188C 'access':124C,148C 'across':231C 'alloc':156C 'altern':152C 'approach':153C 'attempt':106C 'borrow':170C 'buffer':63B,194C,246C 'byte':12A,57B,90C,180C,186C,206C,255C 'call':214C 'caller':40B,61B,147C,163C,191C,230C 'caller-provid':60B,190C 'caus':100C 'commit':91C 'complic':227C 'consist':164C 'copi':54B,209C 'could':35B 'count':131C 'cve':13A,16A 'dep':238C 'destin':245C 'digit':237C 'driver':232C 'drop':47B,132C 'dynam':155C 'e.g':157C 'earli':51B 'earlier':45B 'ensur':220C 'find':104C 'fix':46B,53B,80C,95C,108C,172C 'follow':74C 'free':7A,84C,99C,113C,145C 'freed':37B,137C 'gb':126C,196C,201C,212C 'general':11A,56B,89C,179C,185C,205C,254C 'get':87C,183C,252C 'howev':127C 'immedi':138C 'introduc':159C 'invok':117C 'issu':115C 'kernel':2A,21B,26B,72C 'kmemdup':158C 'lead':139C 'leak':161C 'len':203C 'length':200C 'lifetim':222C 'linux':1A,20B,25B,71C 'linux-kernel':19B 'llcp':10A,103C,119C,178C,216C 'local':88C,105C,120C,122C,125C,135C,184C,217C,219C,253C 'manag':223C 'max':202C 'maximum':199C 'memori':33B,160C,171C 'microread':233C 'nci':240C 'net':93C 'nfc':3A,22B,27B,79C,86C,94C,102C,118C,177C,182C,215C,251C 'output':193C 'ownership':225C 'pass':248C 'pn533':234C 'pn544':235C 'pointer':31B,151C,168C 'proper':174C 'provid':62B,192C,242C 'put':121C,218C 'read':9A 'refactor':176C 'refer':49B,66B,130C 'releas':68B 'resolv':78C 'return':29B,150C,167C 'runtim':23B 'safe':208C,221C 'st21nfca':236C 'subsystem':28B 'transfer':226C 'treat':165C 'uaf':114C 'updat':228C 'use':5A,41B,82C,97C,111C,143C,154C 'use-after-fre':4A,81C,96C,110C,142C 'vulner':75C 'without':224C 'zero':134C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98483","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-19T10:18:59+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}