Live › vulnerability › CVE-2026-98578
Go to dashboardThe st21nfca NFC driver's ISO15693 inventory handler strips a two-byte prefix without checking the data is long enough, then reads a DSFID byte that may be missing. An attacker able to send crafted NFC response data could cause an out-of-bounds read in the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems with an st21nfca NFC controller, which is mostly certain embedded boards and some laptops, have this driver active. Servers and cloud VMs without NFC hardware are not exposed, and the sources do not say whether the NFC reader can be reached remotely.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the fix, which the sources do not statelsmod | grep st21nfca to see whether the st21nfca NFC driver is loaded at allst21nfca module on systems without this NFC hardware.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nfc: st21nfca: validate ISO15693 inventory length
The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID.
Require the prefix and at least two remaining bytes before copying the UID data and reading the DSFID.
This page as .md · .json · in your agent: get_signal("CVE-2026-98578")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.