{"id":"CVE-2026-98578","kind":"vulnerability","aliases":["CVE-2026-98578"],"related":[],"title":"Linux kernel NFC driver: missing length check reads past a buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate ISO15693 inventory length\n\nThe ISO15693 inventory helper removes a two-byte prefix without checking\nthat it exists, then accepts a one-byte remainder before reading data[1] as\nthe DSFID.\n\nRequire the prefix and at least two remaining bytes before copying the UID\ndata and reading the DSFID.","summary":"The st21nfca NFC driver's ISO15693 inventory handler strips a two-byte prefix without checking the data is long enough, then reads a DSFID byte that may be missing. An attacker able to send crafted NFC response data could cause an out-of-bounds read in the kernel.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","kernel","linux","nfc"],"not_affected_if":["module-not-loaded","no-st21nfca-hardware"],"how_to_check":"- `uname -r` and compare against the kernel version that carries the fix, which the sources do not state\n- `lsmod | grep st21nfca` to see whether the st21nfca NFC driver is loaded at all","fix":"- Update the Linux kernel to a release that includes the upstream commit validating ISO15693 inventory length; the sources do not name the version.\n- Blacklist or leave unloaded the `st21nfca` module on systems without this NFC hardware.","status":"open","published_at":"2026-10-18T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:06+00:00","updated_at":"2026-10-25T05:23:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:23:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit validating ISO15693 inventory length; the sources do not name the version.\n- Blacklist or leave unloaded the `st21nfca` module on systems without this NFC hardware.","reach":"local","title":"Linux kernel NFC driver: missing length check reads past a buffer","impact":"low","summary":"The st21nfca NFC driver's ISO15693 inventory handler strips a two-byte prefix without checking the data is long enough, then reads a DSFID byte that may be missing. An attacker able to send crafted NFC response data could cause an out-of-bounds read in the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","nfc","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel out-of-bounds read from NFC response data, possible crash","analyst_note":"","how_to_check":"- `uname -r` and compare against the kernel version that carries the fix, which the sources do not state\n- `lsmod | grep st21nfca` to see whether the st21nfca NFC driver is loaded at all","needs_analyst":false,"not_affected_if":["no-st21nfca-hardware","module-not-loaded"],"who_is_affected":"Only systems with an st21nfca NFC controller, which is mostly certain embedded boards and some laptops, have this driver active. Servers and cloud VMs without NFC hardware are not exposed, and the sources do not say whether the NFC reader can be reached remotely.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00062,"input_tokens":3354,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98578':14A,17A '1':114C 'abl':55B 'accept':105C 'attack':54B 'bound':68B 'buffer':11A 'byte':35B,48B,97C,109C,126C 'caus':63B 'check':7A,38B,100C 'copi':128C 'could':62B 'craft':58B 'cve':12A,15A 'data':40B,61B,113C,131C 'driver':4A,26B 'dsfid':47B,117C,135C 'embed':18B 'enough':43B 'exist':103C 'follow':78C 'handler':30B 'helper':92C 'infrastructur':19B 'inventori':29B,87C,91C 'iso15693':28B,86C,90C 'kernel':2A,20B,72B,76C 'least':123C 'length':6A,88C 'linux':1A,21B,75C 'long':42B 'may':50B 'miss':5A,52B 'nfc':3A,22B,25B,59B,83C 'one':108C 'one-byt':107C 'out-of-bound':65B 'past':9A 'prefix':36B,98C,120C 'read':8A,45B,69B,112C,133C 'remain':125C 'remaind':110C 'remov':93C 'requir':118C 'resolv':82C 'respons':60B 'send':57B 'st21nfca':24B,84C 'strip':31B 'two':34B,96C,124C 'two-byt':33B,95C 'uid':130C 'valid':85C 'vulner':79C 'without':37B,99C","nicknames":[],"mitigations":[],"who_affected":"Only systems with an st21nfca NFC controller, which is mostly certain embedded boards and some laptops, have this driver active. Servers and cloud VMs without NFC hardware are not exposed, and the sources do not say whether the NFC reader can be reached remotely.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98578","severity":null,"published_at":"2026-10-18T16:17:10+00:00","modified_at":"2026-10-19T10:19:17+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}