{"schema":"threatline.record/2","record":{"id":"CVE-2026-98583","aliases":[],"summary":"nfc: nfcmrvl: validate helper command length before pull","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nfcmrvl: validate helper command length before pull\n\nThe firmware download receive path removes the NCI data header and\nreads the helper command before validating the remaining packet length.\nA short frame can therefore reach the data access before the malformed\npacket is rejected.\n\nValidate the complete helper command length before stripping the NCI\ndata header.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98583","source_modified_at":"2026-10-19T09:22:09.019Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"3194c6870158e305dac2af52f83681e9cb67280f","lessThan":"842c0603cfa49530ef081f181a2ddbba77a37231","status":"affected","versionType":"git"},{"version":"3194c6870158e305dac2af52f83681e9cb67280f","lessThan":"e4b012240c8aaf57cec192234c24e0db5f531ffa","status":"affected","versionType":"git"},{"version":"3194c6870158e305dac2af52f83681e9cb67280f","lessThan":"f15ad9d6e9173a037587dded77c904fdae8df380","status":"affected","versionType":"git"},{"version":"3194c6870158e305dac2af52f83681e9cb67280f","lessThan":"a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9","status":"affected","versionType":"git"},{"version":"3194c6870158e305dac2af52f83681e9cb67280f","lessThan":"4d4601e182c8567329be7d919669ec4d847ddd93","status":"affected","versionType":"git"},{"version":"3194c6870158e305dac2af52f83681e9cb67280f","lessThan":"ed2e00bb22c73156bf8030b6204deabb25cf4eb5","status":"affected","versionType":"git"},{"version":"3194c6870158e305dac2af52f83681e9cb67280f","lessThan":"6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c","status":"affected","versionType":"git"},{"version":"3194c6870158e305dac2af52f83681e9cb67280f","lessThan":"686f942332b1667f13f3b8d6a2f50bcfbf42e277","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98583","source_modified_at":"2026-10-19T09:22:09.019Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"4.4","status":"affected"},{"version":"0","lessThan":"4.4","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.55","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.9","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98583","source_modified_at":"2026-10-19T09:22:09.019Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"842c0603cfa49530ef081f181a2ddbba77a37231","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98583","source_modified_at":"2026-10-19T09:22:09.019Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"4d4601e182c8567329be7d919669ec4d847ddd93","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98583","source_modified_at":"2026-10-19T09:22:09.019Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98583","source_modified_at":"2026-10-19T09:22:09.019Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"686f942332b1667f13f3b8d6a2f50bcfbf42e277","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.0021,"percentile":0.1072,"score_date":"2026-10-23"},"published_at":"2026-10-18T15:18:56.360Z","modified_at":"2026-10-19T09:22:09.019Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98583","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:22:09.019Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98583","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/842c0603cfa49530ef081f181a2ddbba77a37231"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/e4b012240c8aaf57cec192234c24e0db5f531ffa"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/f15ad9d6e9173a037587dded77c904fdae8df380"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/4d4601e182c8567329be7d919669ec4d847ddd93"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/ed2e00bb22c73156bf8030b6204deabb25cf4eb5"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/686f942332b1667f13f3b8d6a2f50bcfbf42e277"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:22:09.019Z","content_hash":"96f97b27e5004a3a7451d77aaeef2ebfd1ce3447e51053fd34584a725f5b72f9"}}