All vulnerabilities
CVE-2026-98482

Linux: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3afdbebfee2ef7e9510880868cfb482cbffe6836Also 9b4086eb67a9a3b1ce69fef1b6793827363703ce, 51b6d73373589abb9de4d84767b0db1bc8d395d9 and 5 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3afdbebfee2ef7e9510880868cfb482cbffe6836LinuxCVE List
  • 9b4086eb67a9a3b1ce69fef1b6793827363703ceLinuxCVE List
  • 51b6d73373589abb9de4d84767b0db1bc8d395d9LinuxCVE List
  • 066205553a0106565bcede934f5721c25ebd6e4eLinuxCVE List
  • 18f60ee882403d5b48097f5f6ae45f794e4cc643LinuxCVE List
  • 810f204ef8f61f0c930cf6b3280050b3ee6a8ae7LinuxCVE List
Show all 8 fixed versions
  • 744e61bd06188d8bb068c26a461c252f242b05c9LinuxCVE List
  • 273f9d667cde649f8de9d72b1303cc2f4b658c50LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

nfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via nfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path only guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it with pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs -- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb tailroom. The byte becomes N(R)/N(S); a peer can already set those with a well-formed PDU, so this is acting on uninitialised memory, not new peer control.

Guard the read with pskb_may_pull(), as commit 95674f506c63 ("nfc: llcp: reject PDUs shorter than the LLCP header") did for the two-byte header, so the sequence byte is present and linear before it is read. RR and RNR PDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is longer, so no valid frame is rejected; a truncated PDU is malformed, so return without a DM reply.

Text from CVE List

Affected versions 18

  • Linuxaffected: d646960f7986fefb460a2b062d5ccc8ccfeacc3a before 3afdbebfee2ef7e9510880868cfb482cbffe6836CVE List
  • Linuxaffected: d646960f7986fefb460a2b062d5ccc8ccfeacc3a before 9b4086eb67a9a3b1ce69fef1b6793827363703ceCVE List
  • Linuxaffected: d646960f7986fefb460a2b062d5ccc8ccfeacc3a before 51b6d73373589abb9de4d84767b0db1bc8d395d9CVE List
  • Linuxaffected: d646960f7986fefb460a2b062d5ccc8ccfeacc3a before 066205553a0106565bcede934f5721c25ebd6e4eCVE List
  • Linuxaffected: d646960f7986fefb460a2b062d5ccc8ccfeacc3a before 18f60ee882403d5b48097f5f6ae45f794e4cc643CVE List
  • Linuxaffected: d646960f7986fefb460a2b062d5ccc8ccfeacc3a before 810f204ef8f61f0c930cf6b3280050b3ee6a8ae7CVE List
  • Linuxaffected: d646960f7986fefb460a2b062d5ccc8ccfeacc3a before 744e61bd06188d8bb068c26a461c252f242b05c9CVE List
  • Linuxaffected: d646960f7986fefb460a2b062d5ccc8ccfeacc3a before 273f9d667cde649f8de9d72b1303cc2f4b658c50CVE List
  • Linuxaffected: 3.3CVE List
  • Linuxunaffected: all versions before 3.3CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8