https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 10:03:22 +0000 https://db.gcve.eu/vuln/cve-2026-98481 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfc: port100: reject frames whose declared length exceeds the received data</p> <p>port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame-&gt;datalen) bytes of frame-&gt;data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb-&gt;actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer.</p> <p>Reject a response whose declared frame size does not fit the received length before validating it.</p> <p>Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfc: port100: reject frames whose declared length exceeds the received data</p> <p>port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame-&gt;datalen) bytes of frame-&gt;data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb-&gt;actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer.</p> <p>Reject a response whose declared frame size does not fit the received length before validating it.</p> <p>Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.</p> https://db.gcve.eu/vuln/cve-2026-98481