{"id":"CVE-2026-98576","kind":"vulnerability","aliases":["CVE-2026-98576"],"related":[],"title":"Linux kernel NFC LLCP: debug logging reads past service name buffers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix slab-out-of-bounds reads when logging service names\n\nnfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-\nterminated strings to pr_debug() using the %s format specifier.\nThe buffers are allocated via kmemdup() or come from netlink\nattributes and are not guaranteed to be null-terminated, causing\n__dynamic_pr_debug() to read beyond the allocated region:\n\n  KASAN: slab-out-of-bounds Read in __dynamic_pr_debug\n\nFix both call sites by using %.*s with the explicit length to limit\nthe output to the actual length of the string.","summary":"The Linux kernel NFC LLCP code passes service name strings that are not null-terminated to a debug print routine, so logging can read past the end of the allocated buffer. The sources describe an out-of-bounds read detected by KASAN, not a confirmed code execution or data-disclosure path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","nfc","runtime","self-hosted"],"not_affected_if":["nfc-module-not-loaded","no-nfc-hardware"],"how_to_check":"- Run `uname -r` and check whether the kernel build includes the NFC LLCP fix (the source commit uses %.*s in nfc_llcp_wks_sap and nfc_llcp_build_sdreq_tlv)\n- Check whether the `nfc` module is loaded with `lsmod | grep nfc`","fix":"- Update the Linux kernel to a release that includes the upstream nfc: llcp fix (version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:08+00:00","updated_at":"2026-10-25T05:23:08+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream nfc: llcp fix (version unknown from the sources)","reach":"local","title":"Linux kernel NFC LLCP: debug logging reads past service name buffers","impact":"low","summary":"The Linux kernel NFC LLCP code passes service name strings that are not null-terminated to a debug print routine, so logging can read past the end of the allocated buffer. The sources describe an out-of-bounds read detected by KASAN, not a confirmed code execution or data-disclosure path.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","nfc","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"out-of-bounds memory read during debug logging","analyst_note":"Check the upstream kernel commit and NVD entry to confirm whether reach is local-only and whether any non-debug path reads the buffer.","how_to_check":"- Run `uname -r` and check whether the kernel build includes the NFC LLCP fix (the source commit uses %.*s in nfc_llcp_wks_sap and nfc_llcp_build_sdreq_tlv)\n- Check whether the `nfc` module is loaded with `lsmod | grep nfc`","needs_analyst":true,"not_affected_if":["no-nfc-hardware","nfc-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the NFC subsystem and LLCP support enabled. Hosts without NFC hardware or with the nfc module not loaded are unlikely to reach the affected code path. The sources do not say whether debug logging must be enabled for the read to occur.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000654,"input_tokens":3465,"output_tokens":614,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98576':14A,17A 'actual':185C 'alloc':56B,130C,155C 'attribut':137C 'beyond':153C 'bound':65B,97C,162C 'buffer':11A,57B,128C 'build':110C 'call':170C 'caus':147C 'code':31B,73B 'come':134C 'confirm':72B 'cve':12A,15A 'data':77B 'data-disclosur':76B 'debug':5A,44B,121C,150C,167C 'describ':60B 'detect':67B 'disclosur':78B 'dynam':148C,165C 'end':53B 'execut':74B 'explicit':177C 'fix':92C,168C 'follow':85C 'format':125C 'guarante':141C 'host':25B 'kasan':69B,157C 'kernel':2A,20B,28B,83C 'kmemdup':132C 'length':178C,186C 'limit':180C 'linux':1A,19B,27B,82C 'linux-kernel':18B 'llcp':4A,30B,91C,104C,109C 'log':6A,48B,100C 'name':10A,34B,102C 'netlink':136C 'nfc':3A,21B,29B,90C,103C,108C 'non':115C 'non-nul':114C 'null':40B,116C,145C 'null-termin':39B,144C 'out-of-bound':62B 'output':182C 'pass':32B,113C 'past':8A,51B 'path':79B 'pr':120C,149C,166C 'print':45B 'read':7A,50B,66B,98C,152C,163C 'region':156C 'resolv':89C 'routin':46B 'runtim':22B 'sap':106C 'sdreq':111C 'self':24B 'self-host':23B 'servic':9A,33B,101C 'site':171C 'slab':94C,159C 'slab-out-of-bound':93C,158C 'sourc':59B 'specifi':126C 'string':35B,118C,189C 'termin':41B,117C,146C 'tlv':112C 'use':122C,173C 'via':131C 'vulner':86C 'wks':105C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the NFC subsystem and LLCP support enabled. Hosts without NFC hardware or with the nfc module not loaded are unlikely to reach the affected code path. The sources do not say whether debug logging must be enabled for the read to occur.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98576","severity":null,"published_at":"2026-10-18T16:17:09+00:00","modified_at":"2026-10-19T10:19:16+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}