{"id":"CVE-2026-98577","kind":"vulnerability","aliases":["CVE-2026-98577"],"related":[],"title":"Linux kernel NFC LLCP: short service name hijacks well-known SAP","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()\n\nnfc_llcp_wks_sap() compares only service_name_len bytes, so a short\nservice_name like \"u\" matches longer WKS strings like \"urn:nfc:sn:snep\".\nFix by requiring exact length match before strncmp().","summary":"The Linux kernel NFC LLCP code matches service names by prefix, so a short service name such as \"u\" is treated as a longer well-known service like \"urn:nfc:sn:snep\". An attacker on a near-field link can likely redirect traffic meant for a standard NFC service to their own service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linux-kernel","nfc"],"not_affected_if":["nfc-module-not-loaded","no-nfc-hardware"],"how_to_check":"- unknown","fix":"- Install a Linux kernel release that includes the upstream fix for nfc_llcp_wks_sap() which requires an exact length match before strncmp().","status":"open","published_at":"2026-10-18T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:05+00:00","updated_at":"2026-10-25T05:23:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:23:05Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel release that includes the upstream fix for nfc_llcp_wks_sap() which requires an exact length match before strncmp().","reach":"local","title":"Linux kernel NFC LLCP: short service name hijacks well-known SAP","impact":"low","summary":"The Linux kernel NFC LLCP code matches service names by prefix, so a short service name such as \"u\" is treated as a longer well-known service like \"urn:nfc:sn:snep\". An attacker on a near-field link can likely redirect traffic meant for a standard NFC service to their own service.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","nfc","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker hijacks well-known NFC service traffic on the local link","analyst_note":"Confirm affected kernel version range and the fixing commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98577.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-nfc-hardware","nfc-module-not-loaded"],"who_is_affected":"Systems with the Linux kernel NFC subsystem and LLCP support built in or loaded, such as devices with NFC hardware. Systems without NFC hardware or with the nfc module not loaded are unlikely to be exposed. unknown for exact affected kernel versions.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000608,"input_tokens":3362,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98577':15A,18A 'attack':59B 'byte':113C 'code':30B 'compar':108C 'cve':13A,16A 'embed':19B 'exact':133C 'field':64B 'fix':92C,130C 'follow':85C 'hijack':8A,95C 'infrastructur':20B 'kernel':2A,23B,27B,83C 'known':11A,51B 'len':112C 'length':134C 'like':53B,67B,119C,125C 'link':65B 'linux':1A,22B,26B,82C 'linux-kernel':21B 'llcp':4A,29B,91C,101C,105C 'longer':48B,122C 'match':31B,98C,121C,135C 'meant':70B 'name':7A,33B,40B,111C,118C 'near':63B 'near-field':62B 'nfc':3A,24B,28B,55B,74B,90C,100C,104C,127C 'prefix':35B,97C 'redirect':68B 'requir':132C 'resolv':89C 'sap':12A,94C,103C,107C 'servic':6A,32B,39B,52B,75B,79B,110C,117C 'short':5A,38B,116C 'sn':56B,128C 'snep':57B,129C 'standard':73B 'string':124C 'strncmp':137C 'traffic':69B 'treat':45B 'u':43B,120C 'urn':54B,126C 'via':96C 'vulner':86C 'well':10A,50B 'well-known':9A,49B 'wks':93C,102C,106C,123C","nicknames":[],"mitigations":[],"who_affected":"Systems with the Linux kernel NFC subsystem and LLCP support built in or loaded, such as devices with NFC hardware. Systems without NFC hardware or with the nfc module not loaded are unlikely to be exposed. unknown for exact affected kernel versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98577","severity":null,"published_at":"2026-10-18T16:17:10+00:00","modified_at":"2026-10-19T10:19:16+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}