Live › vulnerability › CVE-2026-98582
Go to dashboardA malformed NFC frame received over I2C by the st21nfca driver can make the kernel read past the end of its receive buffer. The sources describe an out-of-bounds read during frame unstuffing and CRC checking, and the sources do not state the attacker's full capability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems using the st21nfca NFC chip driver over I2C are exposed, typically certain embedded or ARM boards with that NFC controller. Servers and desktops without this hardware are unlikely to load the driver and can skip it.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the upstream fix; the sources do not list fixed versions.lsmod | grep st21nfca.dmesg | grep -i st21nfca.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nfc: st21nfca: validate received frame size
st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it unconditionally reads the byte after an escape marker.
A malformed frame can place EOF immediately after the start marker or can end its data portion with an escape marker. The former leaves too few bytes for check_crc(), while the latter makes the unstuffing loop read past the current skb length.
Require the minimum framing bytes both before and after unstuffing. Use separate input and output cursors while removing byte stuffing, and reject an escape marker without its encoded byte. This keeps malformed frames within the received frame boundary before CRC processing.
This page as .md · .json · in your agent: get_signal("CVE-2026-98582")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.