{"id":"CVE-2026-98583","kind":"vulnerability","aliases":["CVE-2026-98583"],"related":[],"title":"Linux kernel: NFC Marvell driver reads short firmware frames unchecked","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nfcmrvl: validate helper command length before pull\n\nThe firmware download receive path removes the NCI data header and\nreads the helper command before validating the remaining packet length.\nA short frame can therefore reach the data access before the malformed\npacket is rejected.\n\nValidate the complete helper command length before stripping the NCI\ndata header.","summary":"The Linux kernel's nfcmrvl NFC driver strips the NCI data header and reads a helper command before checking the packet length, so a short malformed frame can be read past its bounds. The sources do not state what an attacker gains beyond this out-of-bounds read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","marvell-nfc","nfc-hardware"],"not_affected_if":["nfcmrvl-not-loaded","no-marvell-nfc-hardware"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed in the NVD entry.\n- Check whether the nfcmrvl NFC driver is loaded with `lsmod | grep nfcmrvl`.\n- unknown for other checks; the sources do not say.","fix":"- Update the Linux kernel to a release that includes the nfcmrvl length validation fix; the exact version is unknown from the sources.\n- Until patched, unload the driver with `modprobe -r nfcmrvl` if NFC hardware is not in use.","status":"open","published_at":"2026-10-18T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:01+00:00","updated_at":"2026-10-25T05:23:01+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:23:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the nfcmrvl length validation fix; the exact version is unknown from the sources.\n- Until patched, unload the driver with `modprobe -r nfcmrvl` if NFC hardware is not in use.","reach":"unknown","title":"Linux kernel: NFC Marvell driver reads short firmware frames unchecked","impact":"medium","summary":"The Linux kernel's nfcmrvl NFC driver strips the NCI data header and reads a helper command before checking the packet length, so a short malformed frame can be read past its bounds. The sources do not state what an attacker gains beyond this out-of-bounds read.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","nfc-hardware","marvell-nfc"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the consequence beyond the out-of-bounds read","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed version ranges and the real impact of the out-of-bounds read.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed in the NVD entry.\n- Check whether the nfcmrvl NFC driver is loaded with `lsmod | grep nfcmrvl`.\n- unknown for other checks; the sources do not say.","needs_analyst":true,"not_affected_if":["no-marvell-nfc-hardware","nfcmrvl-not-loaded"],"who_is_affected":"Only systems with the nfcmrvl NFC driver built in or loaded, which is typically machines with Marvell NFC hardware. Systems without Marvell NFC chips or with the module absent can skip it. The sources do not say whether the driver is reachable remotely.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000667,"input_tokens":3343,"output_tokens":666,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98583':13A,16A 'access':123C 'attack':67B 'beyond':69B 'bound':59B,74B 'check':45B 'command':43B,90C,108C,134C 'complet':132C 'cve':11A,14A 'data':37B,102C,122C,140C 'download':96C 'driver':5A,33B 'firmwar':8A,95C 'follow':81C 'frame':9A,53B,117C 'gain':68B 'hardwar':26B 'header':38B,103C,141C 'helper':42B,89C,107C,133C 'infrastructur':17B 'kernel':2A,20B,29B,79C 'length':48B,91C,114C,135C 'linux':1A,19B,28B,78C 'linux-kernel':18B 'malform':52B,126C 'marvel':4A,22B 'marvell-nfc':21B 'nci':36B,101C,139C 'nfc':3A,23B,25B,32B,86C 'nfc-hardwar':24B 'nfcmrvl':31B,87C 'out-of-bound':71B 'packet':47B,113C,127C 'past':57B 'path':98C 'pull':93C 'reach':120C 'read':6A,40B,56B,75B,105C 'receiv':97C 'reject':129C 'remain':112C 'remov':99C 'resolv':85C 'short':7A,51B,116C 'sourc':61B 'state':64B 'strip':34B,137C 'therefor':119C 'uncheck':10A 'valid':88C,110C,130C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Only systems with the nfcmrvl NFC driver built in or loaded, which is typically machines with Marvell NFC hardware. Systems without Marvell NFC chips or with the module absent can skip it. The sources do not say whether the driver is reachable remotely.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98583","severity":null,"published_at":"2026-10-18T16:17:10+00:00","modified_at":"2026-10-19T10:19:19+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}