CVE-2026-98575

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98575", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.358Z", "datePublished": "2026-10-18T15:18:40.577Z", "dateUpdated": "2026-10-19T09:22:00.641Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:00.641Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()\n\nframe->ccid.datalen is read directly from the USB response frame\nand used, unchecked, as an index into frame->data[]. A malicious or\nmalfunctioning device can set this field to an arbitrary value,\ncausing the driver to read far outside the received buffer.\n\nBound ccid.datalen against the maximum possible ACR122 frame size\nbefore using it. This replaces the existing datalen == 0 check,\nsince datalen < 2 already covers that case and additionally\nrejects datalen == 1, which would still underflow the\n\"datalen - 2\" offset used below."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nfc/pn533/usb.c"], "versions": [{"version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "lessThan": "8db3b1e012a8b25078dfa1efabe3d0cd2916dcba", "status": "affected", "versionType": "git"}, {"version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "lessThan": "74b3fbc60907ee97e3af3249091f57351b53a6d6", "status": "affected", "versionType": "git"}, {"version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "lessThan": "8a0f1bb790d964893db7fc59febda9a534db07b3", "status": "affected", "versionType": "git"}, {"version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "lessThan": "ea82b7576793219fa10a8b545f8338998b2a9ce2", "status": "affected", "versionType": "git"}, {"version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "lessThan": "72b8b2126e854d6756a1aa4bdc66d7457b832294", "status": "affected", "versionType": "git"}, {"version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "lessThan": "e72cbedc4596e808d22dd2b9fff666ece76f8dd6", "status": "affected", "versionType": "git"}, {"version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "lessThan": "2450a388367231fb7dd798538f393af227c00c4d", "status": "affected", "versionType": "git"}, {"version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "lessThan": "b61732f47316d45f27706db7812950145d3327b5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nfc/pn533/usb.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8db3b1e012a8b25078dfa1efabe3d0cd2916dcba"}, {"url": "https://git.kernel.org/stable/c/74b3fbc60907ee97e3af3249091f57351b53a6d6"}, {"url": "https://git.kernel.org/stable/c/8a0f1bb790d964893db7fc59febda9a534db07b3"}, {"url": "https://git.kernel.org/stable/c/ea82b7576793219fa10a8b545f8338998b2a9ce2"}, {"url": "https://git.kernel.org/stable/c/72b8b2126e854d6756a1aa4bdc66d7457b832294"}, {"url": "https://git.kernel.org/stable/c/e72cbedc4596e808d22dd2b9fff666ece76f8dd6"}, {"url": "https://git.kernel.org/stable/c/2450a388367231fb7dd798538f393af227c00c4d"}, {"url": "https://git.kernel.org/stable/c/b61732f47316d45f27706db7812950145d3327b5"}], "title": "nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nfc/pn533/usb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8db3b1e012a8b25078dfa1efabe3d0cd2916dcba", "status": "affected", "version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "versionType": "git"}, {"lessThan": "74b3fbc60907ee97e3af3249091f57351b53a6d6", "status": "affected", "version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "versionType": "git"}, {"lessThan": "8a0f1bb790d964893db7fc59febda9a534db07b3", "status": "affected", "version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "versionType": "git"}, {"lessThan": "ea82b7576793219fa10a8b545f8338998b2a9ce2", "status": "affected", "version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "versionType": "git"}, {"lessThan": "72b8b2126e854d6756a1aa4bdc66d7457b832294", "status": "affected", "version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "versionType": "git"}, {"lessThan": "e72cbedc4596e808d22dd2b9fff666ece76f8dd6", "status": "affected", "version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "versionType": "git"}, {"lessThan": "2450a388367231fb7dd798538f393af227c00c4d", "status": "affected", "version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "versionType": "git"}, {"lessThan": "b61732f47316d45f27706db7812950145d3327b5", "status": "affected", "version": "9815c7cf22daceabfb919ddcd6f2c80e049c1fbc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nfc/pn533/usb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()\n\nframe->ccid.datalen is read directly from the USB response frame\nand used, unchecked, as an index into frame->data[]. A malicious or\nmalfunctioning device can set this field to an arbitrary value,\ncausing the driver to read far outside the received buffer.\n\nBound ccid.datalen against the maximum possible ACR122 frame size\nbefore using it. This replaces the existing datalen == 0 check,\nsince datalen < 2 already covers that case and additionally\nrejects datalen == 1, which would still underflow the\n\"datalen - 2\" offset used below."}], "id": "CVE-2026-98575", "lastModified": "2026-10-19T10:19:16.573", "metrics": {}, "published": "2026-10-18T16:17:09.810", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2450a388367231fb7dd798538f393af227c00c4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72b8b2126e854d6756a1aa4bdc66d7457b832294"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74b3fbc60907ee97e3af3249091f57351b53a6d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8a0f1bb790d964893db7fc59febda9a534db07b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8db3b1e012a8b25078dfa1efabe3d0cd2916dcba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b61732f47316d45f27706db7812950145d3327b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e72cbedc4596e808d22dd2b9fff666ece76f8dd6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea82b7576793219fa10a8b545f8338998b2a9ce2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()", "id": "2554938", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554938"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()\nframe->ccid.datalen is read directly from the USB response frame\nand used, unchecked, as an index into frame->data[]. A malicious or\nmalfunctioning device can set this field to an arbitrary value,\ncausing the driver to read far outside the received buffer.\nBound ccid.datalen against the maximum possible ACR122 frame size\nbefore using it. This replaces the existing datalen == 0 check,\nsince datalen < 2 already covers that case and additionally\nrejects datalen == 1, which would still underflow the\n\"datalen - 2\" offset used below.", "A flaw was found in the Linux kernel's PN533 NFC (Near Field Communication) driver. An attacker capable of connecting a malicious or malfunctioning USB device can supply a crafted response frame with an arbitrary data length value. Because the driver fails to validate this length against maximum frame boundaries before indexing the buffer, an out-of-bounds read occurs, potentially causing a Denial of Service (DoS) via system crash or disclosing sensitive kernel memory."], "name": "CVE-2026-98575", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98575\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98575\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98575.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,8db3b1e012a8b25078dfa1efabe3d0cd2916dcba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,74b3fbc60907ee97e3af3249091f57351b53a6d6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,8a0f1bb790d964893db7fc59febda9a534db07b3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,ea82b7576793219fa10a8b545f8338998b2a9ce2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,72b8b2126e854d6756a1aa4bdc66d7457b832294)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,e72cbedc4596e808d22dd2b9fff666ece76f8dd6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,2450a388367231fb7dd798538f393af227c00c4d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,b61732f47316d45f27706db7812950145d3327b5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:00:10.134096+00:00", "updated": "2026-10-20T20:00:15.861869+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}