CVE-2026-98482 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
nfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via
nfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path only guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it with pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs -- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb tailroom. The byte becomes N(R)/N(S); a peer can already set those with a well-formed PDU, so this is acting on uninitialised memory, not new peer control.
Guard the read with pskb_may_pull(), as commit 95674f506c63 ("nfc: llcp: reject PDUs shorter than the LLCP header") did for the two-byte header, so the sequence byte is present and linear before it is read. RR and RNR PDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is longer, so no valid frame is rejected; a truncated PDU is malformed, so return without a DM reply.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability resides within the Near Field Communication (NFC) subsystem of the Linux kernel, specifically in the Link Control Protocol (LLCP) implementation found in the nfc_llcp_recv_hdlc function. This component is responsible for handling High-Level Data-Link Protocol data units during NFC communication sessions. The core technical flaw involves an out-of-bounds read condition triggered by insufficient length validation prior to accessing packet buffer data. Specifically, the code attempts to access the sequence byte located at offset two within the socket buffer's data area via helper functions nfc_llcp_ns and nfc_llcp_nr before verifying that the entire expected PDU structure is present in memory. While the receive path does guarantee a minimum two-byte LLCP header through checks performed by __nfc_llcp_recv using pskb_may_pull, this validation is insufficient for I, RR, or RNR PDUs which require additional bytes beyond the initial header to be valid and safe to process.
This architectural oversight results in an out-of-bounds read from uninitialised memory when a peer device sends truncated frames that contain only the two-byte header but lack the subsequent sequence information. The kernel reads one byte of uninitialised socket buffer tailroom, interpreting this random data as either N(R) or N(S), which are critical flow control parameters in LLCP. Although an attacker cannot directly inject arbitrary values into these fields through well-formed PDUs because valid frames must include them, the act of reading from uninitialised memory constitutes a significant security risk. This behavior aligns with CWE-125, Out-of-bounds Read, as it involves accessing memory beyond the intended buffer boundaries without proper bounds checking. The potential impact includes information disclosure if the uninitialised memory contains sensitive kernel data that could be exfiltrated through subsequent protocol interactions or side-channel effects, although the immediate exploitation vector is limited to reading static uninitialised stack or heap padding depending on allocation context.
From an operational perspective, this vulnerability allows a remote NFC peer device to trigger undefined behavior within the kernel by sending malformed LLCP frames. While the current implementation does not allow direct control over N(R) and N(S values through valid PDUs, the reliance on uninitialised memory for these critical flow-control variables introduces unpredictability into the connection state machine. This can potentially lead to denial of service conditions if the random value causes protocol state inconsistencies or crashes in dependent subsystems that rely on accurate sequence tracking. The vulnerability is particularly concerning because NFC interfaces are often exposed to physical proximity attackers who may attempt to fuzz input data during pairing or communication setup phases.
The remediation strategy implemented by the maintainers involves enforcing strict length validation before any access to PDU-specific fields. By guarding the read operation with pskb_may_pull, as previously done for the two-byte header check in commit 95674f506c63, the kernel ensures that all necessary bytes are present and linearly accessible within the socket buffer before processing begins. This approach correctly identifies truncated PDUs as malformed and discards them without attempting to parse their contents or sending a Disconnect Mode reply. This fix aligns with ATT&CK technique T1505.003, Server Software Component: Stored Web Shell, in the broader context of input validation failures that lead to code execution or state corruption, although more accurately it maps to improper input validation leading to information leakage. Organizations should ensure their Linux kernels are updated to include this patch and verify that NFC drivers enforce strict adherence to LLCP specification frame lengths before processing any incoming data units.