CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names
A local attacker can trigger slab-out-of-bounds reads in the Linux kernel NFC LLCP subsystem, potentially leaking memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98576?
CVE-2026-98576 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: fix slab-out-of-bounds reads when logging service names
nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null- terminated strings to pr_debug() using the %s format specifier. The buffers are allocated via kmemdup() or come from netlink attributes and are not guaranteed to be null-terminated, causing __dynamic_pr_debug() to read beyond the allocated region:
KASAN: slab-out-of-bounds Read in __dynamic_pr_debug
Fix both call sites by using %.*s with the explicit length to limit the output to the actual length of the string.
Which versions are affected by CVE-2026-98576?
How do I fix CVE-2026-98576?
Apply the vendor's patch.
Is CVE-2026-98576 being exploited?
There is no known exploitation of CVE-2026-98576 in the wild and no public exploit code.
Sources
Also known as AZL-109277, BELL-CVE-2026-98576, DEBIAN-CVE-2026-98576, GHSA-4wv6-7jcw-864j, UBUNTU-CVE-2026-98576.