{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98482", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.352Z", "datePublished": "2026-10-18T15:15:56.227Z", "dateUpdated": "2026-10-19T09:20:19.712Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:19.712Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()\n\nnfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via\nnfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path\nonly guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it\nwith pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs\n-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb\ntailroom. The byte becomes N(R)/N(S); a peer can already set those with\na well-formed PDU, so this is acting on uninitialised memory, not new\npeer control.\n\nGuard the read with pskb_may_pull(), as commit 95674f506c63 (\"nfc: llcp:\nreject PDUs shorter than the LLCP header\") did for the two-byte header,\nso the sequence byte is present and linear before it is read. RR and RNR\nPDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is\nlonger, so no valid frame is rejected; a truncated PDU is malformed, so\nreturn without a DM reply."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/llcp_core.c"], "versions": [{"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "lessThan": "3afdbebfee2ef7e9510880868cfb482cbffe6836", "status": "affected", "versionType": "git"}, {"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "lessThan": "9b4086eb67a9a3b1ce69fef1b6793827363703ce", "status": "affected", "versionType": "git"}, {"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "lessThan": "51b6d73373589abb9de4d84767b0db1bc8d395d9", "status": "affected", "versionType": "git"}, {"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "lessThan": "066205553a0106565bcede934f5721c25ebd6e4e", "status": "affected", "versionType": "git"}, {"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "lessThan": "18f60ee882403d5b48097f5f6ae45f794e4cc643", "status": "affected", "versionType": "git"}, {"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "lessThan": "810f204ef8f61f0c930cf6b3280050b3ee6a8ae7", "status": "affected", "versionType": "git"}, {"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "lessThan": "744e61bd06188d8bb068c26a461c252f242b05c9", "status": "affected", "versionType": "git"}, {"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "lessThan": "273f9d667cde649f8de9d72b1303cc2f4b658c50", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/llcp_core.c"], "versions": [{"version": "3.3", "status": "affected"}, {"version": "0", "lessThan": "3.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3afdbebfee2ef7e9510880868cfb482cbffe6836"}, {"url": "https://git.kernel.org/stable/c/9b4086eb67a9a3b1ce69fef1b6793827363703ce"}, {"url": "https://git.kernel.org/stable/c/51b6d73373589abb9de4d84767b0db1bc8d395d9"}, {"url": "https://git.kernel.org/stable/c/066205553a0106565bcede934f5721c25ebd6e4e"}, {"url": "https://git.kernel.org/stable/c/18f60ee882403d5b48097f5f6ae45f794e4cc643"}, {"url": "https://git.kernel.org/stable/c/810f204ef8f61f0c930cf6b3280050b3ee6a8ae7"}, {"url": "https://git.kernel.org/stable/c/744e61bd06188d8bb068c26a461c252f242b05c9"}, {"url": "https://git.kernel.org/stable/c/273f9d667cde649f8de9d72b1303cc2f4b658c50"}], "title": "nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/nfc/llcp_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3afdbebfee2ef7e9510880868cfb482cbffe6836", "status": "affected", "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "versionType": "git"}, {"lessThan": "9b4086eb67a9a3b1ce69fef1b6793827363703ce", "status": "affected", "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "versionType": "git"}, {"lessThan": "51b6d73373589abb9de4d84767b0db1bc8d395d9", "status": "affected", "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "versionType": "git"}, {"lessThan": "066205553a0106565bcede934f5721c25ebd6e4e", "status": "affected", "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "versionType": "git"}, {"lessThan": "18f60ee882403d5b48097f5f6ae45f794e4cc643", "status": "affected", "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "versionType": "git"}, {"lessThan": "810f204ef8f61f0c930cf6b3280050b3ee6a8ae7", "status": "affected", "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "versionType": "git"}, {"lessThan": "744e61bd06188d8bb068c26a461c252f242b05c9", "status": "affected", "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "versionType": "git"}, {"lessThan": "273f9d667cde649f8de9d72b1303cc2f4b658c50", "status": "affected", "version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/nfc/llcp_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.3"}, {"lessThan": "3.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()\n\nnfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via\nnfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path\nonly guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it\nwith pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs\n-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb\ntailroom. The byte becomes N(R)/N(S); a peer can already set those with\na well-formed PDU, so this is acting on uninitialised memory, not new\npeer control.\n\nGuard the read with pskb_may_pull(), as commit 95674f506c63 (\"nfc: llcp:\nreject PDUs shorter than the LLCP header\") did for the two-byte header,\nso the sequence byte is present and linear before it is read. RR and RNR\nPDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is\nlonger, so no valid frame is rejected; a truncated PDU is malformed, so\nreturn without a DM reply."}], "id": "CVE-2026-98482", "lastModified": "2026-10-19T10:18:59.507", "metrics": {}, "published": "2026-10-18T16:16:58.817", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/066205553a0106565bcede934f5721c25ebd6e4e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/18f60ee882403d5b48097f5f6ae45f794e4cc643"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/273f9d667cde649f8de9d72b1303cc2f4b658c50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3afdbebfee2ef7e9510880868cfb482cbffe6836"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/51b6d73373589abb9de4d84767b0db1bc8d395d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/744e61bd06188d8bb068c26a461c252f242b05c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/810f204ef8f61f0c930cf6b3280050b3ee6a8ae7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b4086eb67a9a3b1ce69fef1b6793827363703ce"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()", "id": "2554900", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554900"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()\nnfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via\nnfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path\nonly guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it\nwith pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs\n-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb\ntailroom. The byte becomes N(R)/N(S); a peer can already set those with\na well-formed PDU, so this is acting on uninitialised memory, not new\npeer control.\nGuard the read with pskb_may_pull(), as commit 95674f506c63 (\"nfc: llcp:\nreject PDUs shorter than the LLCP header\") did for the two-byte header,\nso the sequence byte is present and linear before it is read. RR and RNR\nPDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is\nlonger, so no valid frame is rejected; a truncated PDU is malformed, so\nreturn without a DM reply.", "A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. The Logical Link Control Protocol (LLCP) implementation does not verify the length of incoming network packets before reading sequence information. An attacker within NFC radio range could exploit this by transmitting truncated packets, causing the kernel to read uninitialized memory. This flaw may lead to unexpected connection behavior or a Denial of Service (DoS)."], "name": "CVE-2026-98482", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98482\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98482\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98482.mbox"], "threat_severity": "Moderate"}