CVE-2026-98483 - Vulnerability Details

- nfc: fix use-after-free in nfc_get_local_general_bytes

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: fix use-after-free in nfc_get_local_general_bytes

Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by
nfc_llcp_find_local") attempted to fix a use-after-free (UAF) issue by
invoking nfc_llcp_local_put(local) after accessing local->gb. However,
if the reference count drops to zero, local is freed immediately,
leading to a use-after-free when callers access the returned pointer.
Alternative approaches using dynamic allocation (e.g. kmemdup) introduced
memory leaks because callers consistently treat the returned pointer as
borrowed memory.

Fix this properly by refactoring nfc_llcp_general_bytes() and
nfc_get_local_general_bytes() to accept a caller-provided output buffer
(out_gb) and its maximum length (gb_max_len). The general bytes are
safely copied into out_gb before calling nfc_llcp_local_put(local),
ensuring safe lifetime management without ownership transfer complications.

Update all callers across drivers (microread, pn533, pn544, st21nfca,
digital_dep, and nci) to provide their own destination buffers and pass
them to nfc_get_local_general_bytes().

Published: 2026-10-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

nfc_get_local_general_bytes in the Linux kernel NFC stack contains a use‑after‑free flaw. The bug arises when a local context is released after its reference count reaches zero, yet callers continue to access the freed memory. This results in kernel memory corruption and can be exploited to execute arbitrary code with kernel privileges, representing a classic use‑after‑free (CWE‑825) vulnerability.

Affected Systems

The vulnerability affects all Linux kernel builds that include the legacy NFC driver stack before the commit that introduces the fix. Affected drivers include microread, pn533, pn544, st21nfca, digital_dep, and nci. Any system running a kernel older than commit 6709d4b7bc2e is potentially at risk.

Risk and Exploitability

EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw operates in kernel space and the CVSS score of 5.5 indicates moderate severity, the overall risk is moderate but it remains possible to exploit. Exploitation would likely require physical or logical access to an NFC device on the target system and an ability to inject crafted NFC frames, which can trigger the dereference of freed memory and trigger the use‑after‑free. This could lead to a crash or privilege escalation if successfully leveraged.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`96f2c6f272ec04083d828de46285a7d7b17d1aad`	affected	< 25bfa673adc70189c0bc872940421ae59f789cf6
`fc8429f8d86801f092fbfbd257c3af821ac0dcd3`	affected	< 2b31d0cc95856c856ada91f943fb14dfdf29a923
`425d9d3a92df7d96b3cfb7ee5c240293a21cbde3`	affected	< c40f61a6a413f3eaf028e5fe367fd9749e503ab0
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< 19bcfc2a56d0b82919079b5424c5a9a0ac897dcf
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< d8c929e9afdbc33b1876ecb97a517e850449b5bd
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< 841af260ff477f6191872bc3b2e15488615c1827
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< 9ede11e12f965ace97c4e0f606667f24fb41e7e1
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< dcab71a7011918f6fdba7adcec02d217dcb84b8d
`dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548`	affected	—
`b3ad46e155a6d91b36c6e892019a43e3ef3c696d`	affected	—
`e5207c1d69b1a9707615ab6ff9376e59fc096815`	affected	—
`5.10.188`	affected	< 5.10.271
`5.15.121`	affected	< 5.15.222
`6.1.39`	affected	< 6.1.189
`5.4.251`	affected	< 5.5
`6.3.13`	affected	< 6.4
`6.4.4`	affected	< 6.5

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[96f2c6f272ec04083d828de46285a7d7b17d1aad,25bfa673adc70189c0bc872940421ae59f789cf6)`	affected	code_commit	—
`[25bfa673adc70189c0bc872940421ae59f789cf6,2b31d0cc95856c856ada91f943fb14dfdf29a923)`	affected	code_commit	—
`[2b31d0cc95856c856ada91f943fb14dfdf29a923,425d9d3a92df7d96b3cfb7ee5c240293a21cbde3)`	affected	code_commit	—
`[425d9d3a92df7d96b3cfb7ee5c240293a21cbde3,6709d4b7bc2e079241fdef15d1160581c5261c10)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,19bcfc2a56d0b82919079b5424c5a9a0ac897dcf)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,d8c929e9afdbc33b1876ecb97a517e850449b5bd)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,841af260ff477f6191872bc3b2e15488615c1827)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,9ede11e12f965ace97c4e0f606667f24fb41e7e1)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,dcab71a7011918f6fdba7adcec02d217dcb84b8d)`	affected	code_commit	—
`dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548`	affected	code_commit	—
`b3ad46e155a6d91b36c6e892019a43e3ef3c696d`	affected	code_commit	—
`e5207c1d69b1a9707615ab6ff9376e59fc096815`	affected	code_commit	—
`[5.10.188,5.10.271)`	affected	semver	—
`[5.15.121,5.15.222)`	affected	semver	—
`[6.1.39,6.1.189)`	affected	semver	—
`[5.4.251,5.5)`	affected	semver	—
`[6.3.13,6.4)`	affected	semver	—
`[6.4.4,6.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.5`	affected	semver	—
`[0,6.5)`	unaffected	semver	—
`[5.10.271,5.10.*]`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.112,6.12.*]`	unaffected	generic	—
`[6.18.55,6.18.*]`	unaffected	generic	—
`[7.2.9,7.2.*]`	unaffected	generic	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes commit 6709d4b7bc2e or later.
Ensure that the NFC driver modules (microread, pn533, pn544, st21nfca, digital_dep, nci) are rebuilt or replaced with the latest patched versions.
If an immediate kernel upgrade cannot be performed, disable the NFC subsystem by removing the module load entries or configuring the kernel with NFC support disabled (CONFIG_NFC_MTK=n or similar).

Generated by OpenCVE AI on October 23, 2026 at 06:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98483.mbox
https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf
https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6
https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923
https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827
https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1
https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0
https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd
https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d
https://nvd.nist.gov/vuln/detail/CVE-2026-98483
https://www.cve.org/CVERecord?id=CVE-2026-98483

History

Fri, 23 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 21 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98483.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98483 https://www.cve.org/CVERecord?id=CVE-2026-98483
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 19 Oct 2026 00:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc_get_local_general_bytes Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") attempted to fix a use-after-free (UAF) issue by invoking nfc_llcp_local_put(local) after accessing local->gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory. Fix this properly by refactoring nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer (out_gb) and its maximum length (gb_max_len). The general bytes are safely copied into out_gb before calling nfc_llcp_local_put(local), ensuring safe lifetime management without ownership transfer complications. Update all callers across drivers (microread, pn533, pn544, st21nfca, digital_dep, and nci) to provide their own destination buffers and pass them to nfc_get_local_general_bytes().
Title		nfc: fix use-after-free in nfc_get_local_general_bytes
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6 https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923 https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827 https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1 https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0 https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:15:57.275Z

Updated: 2026-10-19T09:20:20.665Z

Reserved: 2026-09-25T10:25:14.352Z

Link: CVE-2026-98483

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:16:58.940

Modified: 2026-10-19T10:18:59.677

Link: CVE-2026-98483

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98483 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T07:00:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object