Live › vulnerability › CVE-2026-98583
Go to dashboardThe Linux kernel's nfcmrvl NFC driver strips the NCI data header and reads a helper command before checking the packet length, so a short malformed frame can be read past its bounds. The sources do not state what an attacker gains beyond this out-of-bounds read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems with the nfcmrvl NFC driver built in or loaded, which is typically machines with Marvell NFC hardware. Systems without Marvell NFC chips or with the module absent can skip it. The sources do not say whether the driver is reachable remotely.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel versions listed in the NVD entry.lsmod | grep nfcmrvl.modprobe -r nfcmrvl if NFC hardware is not in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nfc: nfcmrvl: validate helper command length before pull
The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach the data access before the malformed packet is rejected.
Validate the complete helper command length before stripping the NCI data header.
This page as .md · .json · in your agent: get_signal("CVE-2026-98583")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.