CVE-2026-98482 - Vulnerability Details

- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

nfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via
nfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path
only guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it
with pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs
-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb
tailroom. The byte becomes N(R)/N(S); a peer can already set those with
a well-formed PDU, so this is acting on uninitialised memory, not new
peer control.

Guard the read with pskb_may_pull(), as commit 95674f506c63 ("nfc: llcp:
reject PDUs shorter than the LLCP header") did for the two-byte header,
so the sequence byte is present and linear before it is read. RR and RNR
PDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is
longer, so no valid frame is rejected; a truncated PDU is malformed, so
return without a DM reply.

Published: 2026-10-18

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw originates in the NFC LLCP receive path where the function nfc_llcp_recv_hdlc() reads a sequence byte from skb->data[2] before any length validation, resulting in an uninitialized memory read. This read may expose kernel data that is not intended for external disclosure. The flaw does not cause a crash or denial of service; it only permits an attacker to read uninitialized memory via a specially crafted truncated LLCP PDU.

Affected Systems

All Linux kernel versions that include the nfc_llcp_recv_hdlc() function and have NFC LLCP enabled are vulnerable. Distribution kernels lacking the commit that guards the read (95674f506c63) are at risk. The issue is vendor‑agnostic and applies to any system running the mainline kernel where NFC LLCP is available.

Risk and Exploitability

The CVSS score is 6.5 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation activity. The attack would require an NFC link from a malicious peer that sends a specially crafted truncated LLCP PDU to the target. Because the vulnerability is limited to an uninitialized memory read, the overall risk is considered low, though a capable adversary could potentially glean kernel memory contents. The patch resolves the issue by rejecting short PDUs before reading the sequence byte, eliminating the uninitialized memory access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d646960f7986fefb460a2b062d5ccc8ccfeacc3a`	affected	< 3afdbebfee2ef7e9510880868cfb482cbffe6836
`d646960f7986fefb460a2b062d5ccc8ccfeacc3a`	affected	< 9b4086eb67a9a3b1ce69fef1b6793827363703ce
`d646960f7986fefb460a2b062d5ccc8ccfeacc3a`	affected	< 51b6d73373589abb9de4d84767b0db1bc8d395d9
`d646960f7986fefb460a2b062d5ccc8ccfeacc3a`	affected	< 066205553a0106565bcede934f5721c25ebd6e4e
`d646960f7986fefb460a2b062d5ccc8ccfeacc3a`	affected	< 18f60ee882403d5b48097f5f6ae45f794e4cc643
`d646960f7986fefb460a2b062d5ccc8ccfeacc3a`	affected	< 810f204ef8f61f0c930cf6b3280050b3ee6a8ae7
`d646960f7986fefb460a2b062d5ccc8ccfeacc3a`	affected	< 744e61bd06188d8bb068c26a461c252f242b05c9
`d646960f7986fefb460a2b062d5ccc8ccfeacc3a`	affected	< 273f9d667cde649f8de9d72b1303cc2f4b658c50

Linux

affected

Version	Status	Constraints
`3.3`	affected	—
`0`	unaffected	< 3.3
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d646960f7986fefb460a2b062d5ccc8ccfeacc3a,3afdbebfee2ef7e9510880868cfb482cbffe6836)`	affected	code_commit	—
`[d646960f7986fefb460a2b062d5ccc8ccfeacc3a,9b4086eb67a9a3b1ce69fef1b6793827363703ce)`	affected	code_commit	—
`[d646960f7986fefb460a2b062d5ccc8ccfeacc3a,51b6d73373589abb9de4d84767b0db1bc8d395d9)`	affected	code_commit	—
`[d646960f7986fefb460a2b062d5ccc8ccfeacc3a,066205553a0106565bcede934f5721c25ebd6e4e)`	affected	code_commit	—
`[d646960f7986fefb460a2b062d5ccc8ccfeacc3a,18f60ee882403d5b48097f5f6ae45f794e4cc643)`	affected	code_commit	—
`[d646960f7986fefb460a2b062d5ccc8ccfeacc3a,810f204ef8f61f0c930cf6b3280050b3ee6a8ae7)`	affected	code_commit	—
`[d646960f7986fefb460a2b062d5ccc8ccfeacc3a,744e61bd06188d8bb068c26a461c252f242b05c9)`	affected	code_commit	—
`[d646960f7986fefb460a2b062d5ccc8ccfeacc3a,273f9d667cde649f8de9d72b1303cc2f4b658c50)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.3`	affected	generic	—
`[0,3.3)`	unaffected	semver	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install a Linux kernel that contains commit 95674f506c63, which guards the read in nfc_llcp_recv_hdlc() and rejects truncated PDUs.
If an update cannot be applied immediately, disable the NFC LLCP stack by removing the nfc kernel module (modprobe -r nfc) or configuring the system to block NFC traffic so that the vulnerable code path is never exercised.
Consult your distribution’s security advisories for any vendor‑specific updates or additional mitigations that address NFC LLCP and apply them as soon as they become available.

Generated by OpenCVE AI on October 23, 2026 at 07:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98482.mbox
https://git.kernel.org/stable/c/066205553a0106565bcede934f5721c25ebd6e4e
https://git.kernel.org/stable/c/18f60ee882403d5b48097f5f6ae45f794e4cc643
https://git.kernel.org/stable/c/273f9d667cde649f8de9d72b1303cc2f4b658c50
https://git.kernel.org/stable/c/3afdbebfee2ef7e9510880868cfb482cbffe6836
https://git.kernel.org/stable/c/51b6d73373589abb9de4d84767b0db1bc8d395d9
https://git.kernel.org/stable/c/744e61bd06188d8bb068c26a461c252f242b05c9
https://git.kernel.org/stable/c/810f204ef8f61f0c930cf6b3280050b3ee6a8ae7
https://git.kernel.org/stable/c/9b4086eb67a9a3b1ce69fef1b6793827363703ce
https://nvd.nist.gov/vuln/detail/CVE-2026-98482
https://www.cve.org/CVERecord?id=CVE-2026-98482

History

Fri, 23 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-788

Wed, 21 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98482.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98482 https://www.cve.org/CVERecord?id=CVE-2026-98482
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 19 Oct 2026 00:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() nfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via nfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path only guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it with pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs -- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb tailroom. The byte becomes N(R)/N(S); a peer can already set those with a well-formed PDU, so this is acting on uninitialised memory, not new peer control. Guard the read with pskb_may_pull(), as commit 95674f506c63 ("nfc: llcp: reject PDUs shorter than the LLCP header") did for the two-byte header, so the sequence byte is present and linear before it is read. RR and RNR PDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is longer, so no valid frame is rejected; a truncated PDU is malformed, so return without a DM reply.
Title		nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/066205553a0106565bcede934f5721c25ebd6e4e https://git.kernel.org/stable/c/18f60ee882403d5b48097f5f6ae45f794e4cc643 https://git.kernel.org/stable/c/273f9d667cde649f8de9d72b1303cc2f4b658c50 https://git.kernel.org/stable/c/3afdbebfee2ef7e9510880868cfb482cbffe6836 https://git.kernel.org/stable/c/51b6d73373589abb9de4d84767b0db1bc8d395d9 https://git.kernel.org/stable/c/744e61bd06188d8bb068c26a461c252f242b05c9 https://git.kernel.org/stable/c/810f204ef8f61f0c930cf6b3280050b3ee6a8ae7 https://git.kernel.org/stable/c/9b4086eb67a9a3b1ce69fef1b6793827363703ce

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:15:56.227Z

Updated: 2026-10-19T09:20:19.712Z

Reserved: 2026-09-25T10:25:14.352Z

Link: CVE-2026-98482

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:16:58.817

Modified: 2026-10-19T10:18:59.507

Link: CVE-2026-98482

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98482 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T07:15:17Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object