{"id":"CVE-2026-98575","kind":"vulnerability","aliases":["CVE-2026-98575"],"related":[],"title":"Linux kernel NFC driver reads past USB buffer on malicious device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()\n\nframe->ccid.datalen is read directly from the USB response frame\nand used, unchecked, as an index into frame->data[]. A malicious or\nmalfunctioning device can set this field to an arbitrary value,\ncausing the driver to read far outside the received buffer.\n\nBound ccid.datalen against the maximum possible ACR122 frame size\nbefore using it. This replaces the existing datalen == 0 check,\nsince datalen < 2 already covers that case and additionally\nrejects datalen == 1, which would still underflow the\n\"datalen - 2\" offset used below.","summary":"The pn533 NFC driver in the Linux kernel trusts a length field from an ACR122 USB reader response and uses it as an array index without a bound check. A malicious or malfunctioning USB device can make the driver read memory outside the received buffer.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","nfc","usb"],"not_affected_if":["driver-not-loaded","no-nfc-reader"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the pn533 fix for pn533_acr122_is_rx_frame_valid(); the sources do not list fixed kernel versions.","status":"open","published_at":"2026-10-18T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:09+00:00","updated_at":"2026-10-25T05:23:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:23:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the pn533 fix for pn533_acr122_is_rx_frame_valid(); the sources do not list fixed kernel versions.","reach":"local","title":"Linux kernel NFC driver reads past USB buffer on malicious device","impact":"low","summary":"The pn533 NFC driver in the Linux kernel trusts a length field from an ACR122 USB reader response and uses it as an array index without a bound check. A malicious or malfunctioning USB device can make the driver read memory outside the received buffer.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","nfc","usb"],"confidence":0.5,"needs_auth":"no","worst_case":"Out-of-bounds kernel memory read; the sources do not state a code execution impact.","analyst_note":"Find the fixed kernel versions and the stable commit for the pn533 datalen bound check in the NVD entry or kernel.org stable tree.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-nfc-reader","driver-not-loaded"],"who_is_affected":"Only machines running a Linux kernel with the pn533 NFC driver loaded, typically those with a USB NFC reader such as an ACR122 attached. Exposure needs a malicious or faulty USB device plugged into the host, so systems without NFC readers or with the driver blocked are unlikely to be affected. The sources do not say which kernel versions are vulnerable.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000621,"input_tokens":3449,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98575':14A,17A '0':149C '1':162C '2':153C,169C 'acr122':37B,85C,138C 'addit':159C 'alreadi':154C 'arbitrari':120C 'array':46B 'bound':50B,132C 'buffer':8A,67B,131C 'case':157C 'caus':122C 'ccid.datalen':91C,133C 'check':51B,150C 'cover':155C 'cve':12A,15A 'data':108C 'datalen':148C,152C,161C,168C 'devic':11A,57B,113C 'direct':94C 'driver':4A,26B,61B,124C 'exist':147C 'far':127C 'field':34B,117C 'fix':80C 'follow':73C 'frame':88C,90C,99C,107C,139C 'index':47B,105C 'infrastructur':18B 'kernel':2A,19B,30B,71C 'length':33B 'linux':1A,20B,29B,70C 'make':59B 'malfunct':55B,112C 'malici':10A,53B,110C 'maximum':136C 'memori':63B 'nfc':3A,21B,25B,78C 'offset':170C 'oob':81C 'outsid':64B,128C 'past':6A 'pn533':24B,79C,84C 'possibl':137C 'read':5A,62B,82C,93C,126C 'reader':39B 'receiv':66B,130C 'reject':160C 'replac':145C 'resolv':77C 'respons':40B,98C 'rx':87C 'set':115C 'sinc':151C 'size':140C 'still':165C 'trust':31B 'uncheck':102C 'underflow':166C 'usb':7A,22B,38B,56B,97C 'use':42B,101C,142C,171C 'valid':89C 'valu':121C 'vulner':74C 'without':48B 'would':164C","nicknames":[],"mitigations":[],"who_affected":"Only machines running a Linux kernel with the pn533 NFC driver loaded, typically those with a USB NFC reader such as an ACR122 attached. Exposure needs a malicious or faulty USB device plugged into the host, so systems without NFC readers or with the driver blocked are unlikely to be affected. The sources do not say which kernel versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98575","severity":null,"published_at":"2026-10-18T16:17:09+00:00","modified_at":"2026-10-19T10:19:16+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}