Live › vulnerability › CVE-2026-98576
Go to dashboardThe Linux kernel NFC LLCP code passes service name strings that are not null-terminated to a debug print routine, so logging can read past the end of the allocated buffer. The sources describe an out-of-bounds read detected by KASAN, not a confirmed code execution or data-disclosure path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the NFC subsystem and LLCP support enabled. Hosts without NFC hardware or with the nfc module not loaded are unlikely to reach the affected code path. The sources do not say whether debug logging must be enabled for the read to occur.
No product ranges from the sources yet.
uname -r and check whether the kernel build includes the NFC LLCP fix (the source commit uses %.*s in nfc_llcp_wks_sap and nfc_llcp_build_sdreq_tlv)nfc module is loaded with lsmod | grep nfcEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: fix slab-out-of-bounds reads when logging service names
nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null- terminated strings to pr_debug() using the %s format specifier. The buffers are allocated via kmemdup() or come from netlink attributes and are not guaranteed to be null-terminated, causing __dynamic_pr_debug() to read beyond the allocated region:
KASAN: slab-out-of-bounds Read in __dynamic_pr_debug
Fix both call sites by using %.*s with the explicit length to limit the output to the actual length of the string.
This page as .md · .json · in your agent: get_signal("CVE-2026-98576")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.