CVE-2026-98481 nfc: port100: reject frames whose declared length exceeds the received data
A malicious NFC device can trigger an out-of-bounds read in the Linux kernel port100 driver by declaring a frame length larger than the actual received data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98481?
CVE-2026-98481 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfc: port100: reject frames whose declared length exceeds the received data
port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer.
Reject a response whose declared frame size does not fit the received length before validating it.
Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.
Which versions are affected by CVE-2026-98481?
How do I fix CVE-2026-98481?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98481 being exploited?
There is no known exploitation of CVE-2026-98481 in the wild and no public exploit code.
Sources
Also known as AZL-108668, BELL-CVE-2026-98481, DEBIAN-CVE-2026-98481, GHSA-76wj-ccjf-8q4p, UBUNTU-CVE-2026-98481.