---
id: "CVE-2026-98582"
kind: "vulnerability"
aliases: ["CVE-2026-98582"]
title: "Linux kernel NFC st21nfca driver: malformed frame reads past buffer"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "linux-kernel", "nfc", "runtime"]
not_affected_if: ["driver-not-loaded", "no-st21nfca-hardware"]
published_at: "2026-10-18T16:17:10+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:23:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98582", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel NFC st21nfca driver: malformed frame reads past buffer

A malformed NFC frame received over I2C by the st21nfca driver can make the kernel read past the end of its receive buffer. The sources describe an out-of-bounds read during frame unstuffing and CRC checking, and the sources do not state the attacker's full capability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the kernel version that carries the upstream fix; the sources do not list fixed versions.
- Check whether the st21nfca driver is loaded with `lsmod | grep st21nfca`.
- Check whether the hardware is present with `dmesg | grep -i st21nfca`.

## Fix

- Update the Linux kernel to a release that includes the upstream st21nfca fix (version unknown from the sources).
- If the driver is not needed, blacklist the st21nfca module.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98582

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate received frame size

st21nfca_hci_i2c_repack() trims a received frame at its EOF marker
before removing byte stuffing.  It then assumes the truncated frame
contains the LLC header and two CRC bytes, and it unconditionally reads
the byte after an escape marker.

A malformed frame can place EOF immediately after the start marker or can
end its data portion with an escape marker.  The former leaves too few
bytes for check_crc(), while the latter makes the unstuffing loop read past
the current skb length.

Require the minimum framing bytes both before and after unstuffing.  Use
separate input and output cursors while removing byte stuffing, and reject
an escape marker without its encoded byte.  This keeps malformed frames
within the received frame boundary before CRC processing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_