FKIE_CVE-2026-98582

Vulnerability from fkie_nvd - Published: 2026-10-18 16:17 - Updated: 2026-10-19 10:19
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it unconditionally reads the byte after an escape marker. A malformed frame can place EOF immediately after the start marker or can end its data portion with an escape marker. The former leaves too few bytes for check_crc(), while the latter makes the unstuffing loop read past the current skb length. Require the minimum framing bytes both before and after unstuffing. Use separate input and output cursors while removing byte stuffing, and reject an escape marker without its encoded byte. This keeps malformed frames within the received frame boundary before CRC processing.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/57919d0662d8856211b794140172e51ca389f23d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7b996cc06dda54c02a5aa607bda01109f0ac51e6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8934d2889ae16a7c77520e002398d0689c1ecea5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/91be5161f37b0a2795ad6806d69be5fa74522e5c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a653c01ce447f10c36b901646888c0330363af4f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d0596ee6c4b928a5c288790522a7495ee867da72
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d4008c3499dba7829bfe002edd99a8bff8ae3a7c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f526c218a149a30f110ce434ff17e033042404b8
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nfc/st21nfca/i2c.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8934d2889ae16a7c77520e002398d0689c1ecea5",
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "versionType": "git"
            },
            {
              "lessThan": "d0596ee6c4b928a5c288790522a7495ee867da72",
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "versionType": "git"
            },
            {
              "lessThan": "f526c218a149a30f110ce434ff17e033042404b8",
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "versionType": "git"
            },
            {
              "lessThan": "d4008c3499dba7829bfe002edd99a8bff8ae3a7c",
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "versionType": "git"
            },
            {
              "lessThan": "91be5161f37b0a2795ad6806d69be5fa74522e5c",
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "versionType": "git"
            },
            {
              "lessThan": "57919d0662d8856211b794140172e51ca389f23d",
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "versionType": "git"
            },
            {
              "lessThan": "7b996cc06dda54c02a5aa607bda01109f0ac51e6",
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "versionType": "git"
            },
            {
              "lessThan": "a653c01ce447f10c36b901646888c0330363af4f",
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nfc/st21nfca/i2c.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate received frame size\n\nst21nfca_hci_i2c_repack() trims a received frame at its EOF marker\nbefore removing byte stuffing.  It then assumes the truncated frame\ncontains the LLC header and two CRC bytes, and it unconditionally reads\nthe byte after an escape marker.\n\nA malformed frame can place EOF immediately after the start marker or can\nend its data portion with an escape marker.  The former leaves too few\nbytes for check_crc(), while the latter makes the unstuffing loop read past\nthe current skb length.\n\nRequire the minimum framing bytes both before and after unstuffing.  Use\nseparate input and output cursors while removing byte stuffing, and reject\nan escape marker without its encoded byte.  This keeps malformed frames\nwithin the received frame boundary before CRC processing."
    }
  ],
  "id": "CVE-2026-98582",
  "lastModified": "2026-10-19T10:19:18.997",
  "metrics": {},
  "published": "2026-10-18T16:17:10.743",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/57919d0662d8856211b794140172e51ca389f23d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7b996cc06dda54c02a5aa607bda01109f0ac51e6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8934d2889ae16a7c77520e002398d0689c1ecea5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/91be5161f37b0a2795ad6806d69be5fa74522e5c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a653c01ce447f10c36b901646888c0330363af4f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d0596ee6c4b928a5c288790522a7495ee867da72"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d4008c3499dba7829bfe002edd99a8bff8ae3a7c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f526c218a149a30f110ce434ff17e033042404b8"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.