CVE-2026-98577 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
nfc_llcp_wks_sap() compares only service_name_len bytes, so a short service_name like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length match before strncmp().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the Linux kernel's Near Field Communication (NFC) subsystem involves a critical logic error within the Link Connectionless Protocol (LLCP) implementation, specifically in the function nfc_llcp_wks_sap. This flaw allows for Service Access Point hijacking through prefix matching rather than exact string comparison. The NFC LLCP layer is responsible for managing connections between devices using Near Field Communication technology, and it relies on Well-Known Services to establish standardized communication channels. These services are identified by specific service names that must be matched precisely to ensure secure and correct protocol operation.
The technical root cause of this vulnerability lies in the implementation of nfc_llcp_wks_sap(), which is tasked with mapping a requested service name to its corresponding Service Access Point number. The function utilizes strncmp() to compare the incoming service_name against known Well-Known Services strings stored in the kernel. However, the comparison logic only checks up to service_name_len bytes. This means that if an attacker provides a short service name string, such as "u", it will be compared against longer registered WKS strings like "urn:nfc:sn:snep". Since strncmp() performs prefix matching when the length parameter is less than or equal to the lengths of both strings being compared, a shorter input can incorrectly match a longer valid service identifier. This behavior violates the expectation that service names must be matched exactly to prevent ambiguity and unauthorized access.
The operational impact of this flaw is significant for systems relying on NFC LLCP services. An attacker with local access or the ability to inject network-like frames in an NFC context could exploit this prefix matching weakness to hijack a Well-Known Service. By sending a request that matches only the beginning characters of a legitimate service name, the malicious actor can trick the kernel into assigning them the SAP number intended for the genuine service. This effectively allows the attacker to impersonate or intercept communications associated with critical NFC services such as SNEP (NFC Smart Exchange Protocol) or other registered well-known services. Such hijacking could lead to unauthorized data access, manipulation of device interactions, or denial of service by disrupting legitimate connections that depend on these specific SAP assignments.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write if the mismatch leads to memory corruption in downstream processing, though primarily it represents a logic error leading to privilege escalation within the protocol stack context. In terms of MITRE ATT&CK mapping, this technique relates to T1563 Remote Service Hijacking or more specifically local exploitation techniques involving service impersonation and resource hijacking (T1072). The lack of strict length validation before string comparison is a classic example of insufficient boundary checking that allows for unexpected behavior in security-critical subsystems.
To mitigate this vulnerability, the Linux kernel developers have implemented a fix that requires an exact length match before invoking strncmp(). This ensures that only service names with identical lengths to the registered Well-Known Services are considered for matching. By enforcing strict equality on both content and length, the system prevents shorter strings from falsely matching longer legitimate identifiers. System administrators should ensure their Linux kernels are updated to include this patch. For environments where NFC functionality is not required, disabling the relevant kernel modules or subsystems can further reduce the attack surface. Continuous monitoring for unusual NFC activity and validating input lengths in custom applications interacting with the NFC stack are also recommended defensive measures.