CVE-2026-98483

nfc: fix use-after-free in nfc_get_local_general_bytes

Published Oct 18, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: fix use-after-free in nfc_get_local_general_bytes

Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by
nfc_llcp_find_local") attempted to fix a use-after-free (UAF) issue by
invoking nfc_llcp_local_put(local) after accessing local->gb. However,
if the reference count drops to zero, local is freed immediately,
leading to a use-after-free when callers access the returned pointer.
Alternative approaches using dynamic allocation (e.g. kmemdup) introduced
memory leaks because callers consistently treat the returned pointer as
borrowed memory.

Fix this properly by refactoring nfc_llcp_general_bytes() and
nfc_get_local_general_bytes() to accept a caller-provided output buffer
(out_gb) and its maximum length (gb_max_len). The general bytes are
safely copied into out_gb before calling nfc_llcp_local_put(local),
ensuring safe lifetime management without ownership transfer complications.

Update all callers across drivers (microread, pn533, pn544, st21nfca,
digital_dep, and nci) to provide their own destination buffers and pass
them to nfc_get_local_general_bytes().

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`96f2c6f272ec04083d828de46285a7d7b17d1aad`	affected	< 25bfa673adc70189c0bc872940421ae59f789cf6
`fc8429f8d86801f092fbfbd257c3af821ac0dcd3`	affected	< 2b31d0cc95856c856ada91f943fb14dfdf29a923
`425d9d3a92df7d96b3cfb7ee5c240293a21cbde3`	affected	< c40f61a6a413f3eaf028e5fe367fd9749e503ab0
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< 19bcfc2a56d0b82919079b5424c5a9a0ac897dcf
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< d8c929e9afdbc33b1876ecb97a517e850449b5bd
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< 841af260ff477f6191872bc3b2e15488615c1827
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< 9ede11e12f965ace97c4e0f606667f24fb41e7e1
`6709d4b7bc2e079241fdef15d1160581c5261c10`	affected	< dcab71a7011918f6fdba7adcec02d217dcb84b8d
`dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548`	affected	—
`b3ad46e155a6d91b36c6e892019a43e3ef3c696d`	affected	—
`e5207c1d69b1a9707615ab6ff9376e59fc096815`	affected	—
`5.10.188`	affected	< 5.10.271
`5.15.121`	affected	< 5.15.222
`6.1.39`	affected	< 6.1.189
`5.4.251`	affected	< 5.5
`6.3.13`	affected	< 6.4
`6.4.4`	affected	< 6.5

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[96f2c6f272ec04083d828de46285a7d7b17d1aad,25bfa673adc70189c0bc872940421ae59f789cf6)`	affected	code_commit	—
`[25bfa673adc70189c0bc872940421ae59f789cf6,2b31d0cc95856c856ada91f943fb14dfdf29a923)`	affected	code_commit	—
`[2b31d0cc95856c856ada91f943fb14dfdf29a923,425d9d3a92df7d96b3cfb7ee5c240293a21cbde3)`	affected	code_commit	—
`[425d9d3a92df7d96b3cfb7ee5c240293a21cbde3,6709d4b7bc2e079241fdef15d1160581c5261c10)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,19bcfc2a56d0b82919079b5424c5a9a0ac897dcf)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,d8c929e9afdbc33b1876ecb97a517e850449b5bd)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,841af260ff477f6191872bc3b2e15488615c1827)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,9ede11e12f965ace97c4e0f606667f24fb41e7e1)`	affected	code_commit	—
`[6709d4b7bc2e079241fdef15d1160581c5261c10,dcab71a7011918f6fdba7adcec02d217dcb84b8d)`	affected	code_commit	—
`dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548`	affected	code_commit	—
`b3ad46e155a6d91b36c6e892019a43e3ef3c696d`	affected	code_commit	—
`e5207c1d69b1a9707615ab6ff9376e59fc096815`	affected	code_commit	—
`[5.10.188,5.10.271)`	affected	semver	—
`[5.15.121,5.15.222)`	affected	semver	—
`[6.1.39,6.1.189)`	affected	semver	—
`[5.4.251,5.5)`	affected	semver	—
`[6.3.13,6.4)`	affected	semver	—
`[6.4.4,6.5)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.5`	affected	semver	—
`[0,6.5)`	unaffected	semver	—
`[5.10.271,5.10.*]`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.112,6.12.*]`	unaffected	generic	—
`[6.18.55,6.18.*]`	unaffected	generic	—
`[7.2.9,7.2.*]`	unaffected	generic	—
`[7.3-rc5,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98483.mbox
https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf
https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6
https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923
https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827
https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1
https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0
https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd
https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d
https://nvd.nist.gov/vuln/detail/CVE-2026-98483
https://www.cve.org/CVERecord?id=CVE-2026-98483

History

Oct 23, 2026 12:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Oct 21, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98483.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98483 https://www.cve.org/CVERecord?id=CVE-2026-98483
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Oct 19, 2026 12:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Oct 18, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc_get_local_general_bytes Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") attempted to fix a use-after-free (UAF) issue by invoking nfc_llcp_local_put(local) after accessing local->gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory. Fix this properly by refactoring nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer (out_gb) and its maximum length (gb_max_len). The general bytes are safely copied into out_gb before calling nfc_llcp_local_put(local), ensuring safe lifetime management without ownership transfer complications. Update all callers across drivers (microread, pn533, pn544, st21nfca, digital_dep, and nci) to provide their own destination buffers and pass them to nfc_get_local_general_bytes().
Title		nfc: fix use-after-free in nfc_get_local_general_bytes
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6 https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923 https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827 https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1 https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0 https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d