https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 21:35:32 +0000 https://db.gcve.eu/vuln/cve-2026-98483 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfc: fix use-after-free in nfc_get_local_general_bytes</p> <p>Commit 6709d4b7bc2e (&#34;net: nfc: Fix use-after-free caused by nfc_llcp_find_local&#34;) attempted to fix a use-after-free (UAF) issue by invoking nfc_llcp_local_put(local) after accessing local-&gt;gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory.</p> <p>Fix this properly by refactoring nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer (out_gb) and its maximum length (gb_max_len). The general bytes are safely copied into out_gb before calling nfc_llcp_local_put(local), ensuring safe lifetime management without ownership transfer complications.</p> <p>Update all callers across drivers (microread, pn533, pn544, st21nfca, digital_dep, and nci) to provide their own destination buffers and pass them to nfc_get_local_general_bytes().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfc: fix use-after-free in nfc_get_local_general_bytes</p> <p>Commit 6709d4b7bc2e (&#34;net: nfc: Fix use-after-free caused by nfc_llcp_find_local&#34;) attempted to fix a use-after-free (UAF) issue by invoking nfc_llcp_local_put(local) after accessing local-&gt;gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory.</p> <p>Fix this properly by refactoring nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer (out_gb) and its maximum length (gb_max_len). The general bytes are safely copied into out_gb before calling nfc_llcp_local_put(local), ensuring safe lifetime management without ownership transfer complications.</p> <p>Update all callers across drivers (microread, pn533, pn544, st21nfca, digital_dep, and nci) to provide their own destination buffers and pass them to nfc_get_local_general_bytes().</p> https://db.gcve.eu/vuln/cve-2026-98483