CVE-2026-98578

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98578", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.358Z", "datePublished": "2026-10-18T15:18:51.807Z", "dateUpdated": "2026-10-19T09:22:03.614Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:03.614Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate ISO15693 inventory length\n\nThe ISO15693 inventory helper removes a two-byte prefix without checking\nthat it exists, then accepts a one-byte remainder before reading data[1] as\nthe DSFID.\n\nRequire the prefix and at least two remaining bytes before copying the UID\ndata and reading the DSFID."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nfc/st21nfca/core.c"], "versions": [{"version": "7974728094d35f38775417a26d8f30ea3602496a", "lessThan": "e47b2a350bb0ff123434ec5484c6dc3333b0727c", "status": "affected", "versionType": "git"}, {"version": "7974728094d35f38775417a26d8f30ea3602496a", "lessThan": "57d183764f3002f9625ee4deeeb20716c519534e", "status": "affected", "versionType": "git"}, {"version": "7974728094d35f38775417a26d8f30ea3602496a", "lessThan": "3af2ea4035581a1607d9830779c187a0c7e225aa", "status": "affected", "versionType": "git"}, {"version": "7974728094d35f38775417a26d8f30ea3602496a", "lessThan": "9fa21b0f78adb514e3bd96a505ddb752e9727ff3", "status": "affected", "versionType": "git"}, {"version": "7974728094d35f38775417a26d8f30ea3602496a", "lessThan": "6353dae51bc9b3cad13c9d890b53311a46c96b4e", "status": "affected", "versionType": "git"}, {"version": "7974728094d35f38775417a26d8f30ea3602496a", "lessThan": "fdd95e819d828c975aaeb258a3fed5dd7fd136d0", "status": "affected", "versionType": "git"}, {"version": "7974728094d35f38775417a26d8f30ea3602496a", "lessThan": "a86987d03a4d39acdbe4533d83db4d656ea36c59", "status": "affected", "versionType": "git"}, {"version": "7974728094d35f38775417a26d8f30ea3602496a", "lessThan": "7f2ea5ed588c03d481f0301e6c3d4240132383fb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nfc/st21nfca/core.c"], "versions": [{"version": "3.16", "status": "affected"}, {"version": "0", "lessThan": "3.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e47b2a350bb0ff123434ec5484c6dc3333b0727c"}, {"url": "https://git.kernel.org/stable/c/57d183764f3002f9625ee4deeeb20716c519534e"}, {"url": "https://git.kernel.org/stable/c/3af2ea4035581a1607d9830779c187a0c7e225aa"}, {"url": "https://git.kernel.org/stable/c/9fa21b0f78adb514e3bd96a505ddb752e9727ff3"}, {"url": "https://git.kernel.org/stable/c/6353dae51bc9b3cad13c9d890b53311a46c96b4e"}, {"url": "https://git.kernel.org/stable/c/fdd95e819d828c975aaeb258a3fed5dd7fd136d0"}, {"url": "https://git.kernel.org/stable/c/a86987d03a4d39acdbe4533d83db4d656ea36c59"}, {"url": "https://git.kernel.org/stable/c/7f2ea5ed588c03d481f0301e6c3d4240132383fb"}], "title": "nfc: st21nfca: validate ISO15693 inventory length", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nfc/st21nfca/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e47b2a350bb0ff123434ec5484c6dc3333b0727c", "status": "affected", "version": "7974728094d35f38775417a26d8f30ea3602496a", "versionType": "git"}, {"lessThan": "57d183764f3002f9625ee4deeeb20716c519534e", "status": "affected", "version": "7974728094d35f38775417a26d8f30ea3602496a", "versionType": "git"}, {"lessThan": "3af2ea4035581a1607d9830779c187a0c7e225aa", "status": "affected", "version": "7974728094d35f38775417a26d8f30ea3602496a", "versionType": "git"}, {"lessThan": "9fa21b0f78adb514e3bd96a505ddb752e9727ff3", "status": "affected", "version": "7974728094d35f38775417a26d8f30ea3602496a", "versionType": "git"}, {"lessThan": "6353dae51bc9b3cad13c9d890b53311a46c96b4e", "status": "affected", "version": "7974728094d35f38775417a26d8f30ea3602496a", "versionType": "git"}, {"lessThan": "fdd95e819d828c975aaeb258a3fed5dd7fd136d0", "status": "affected", "version": "7974728094d35f38775417a26d8f30ea3602496a", "versionType": "git"}, {"lessThan": "a86987d03a4d39acdbe4533d83db4d656ea36c59", "status": "affected", "version": "7974728094d35f38775417a26d8f30ea3602496a", "versionType": "git"}, {"lessThan": "7f2ea5ed588c03d481f0301e6c3d4240132383fb", "status": "affected", "version": "7974728094d35f38775417a26d8f30ea3602496a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nfc/st21nfca/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.16"}, {"lessThan": "3.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate ISO15693 inventory length\n\nThe ISO15693 inventory helper removes a two-byte prefix without checking\nthat it exists, then accepts a one-byte remainder before reading data[1] as\nthe DSFID.\n\nRequire the prefix and at least two remaining bytes before copying the UID\ndata and reading the DSFID."}], "id": "CVE-2026-98578", "lastModified": "2026-10-19T10:19:17.060", "metrics": {}, "published": "2026-10-18T16:17:10.223", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3af2ea4035581a1607d9830779c187a0c7e225aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57d183764f3002f9625ee4deeeb20716c519534e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6353dae51bc9b3cad13c9d890b53311a46c96b4e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f2ea5ed588c03d481f0301e6c3d4240132383fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9fa21b0f78adb514e3bd96a505ddb752e9727ff3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a86987d03a4d39acdbe4533d83db4d656ea36c59"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e47b2a350bb0ff123434ec5484c6dc3333b0727c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fdd95e819d828c975aaeb258a3fed5dd7fd136d0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: nfc: st21nfca: validate ISO15693 inventory length", "id": "2554912", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554912"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfc: st21nfca: validate ISO15693 inventory length\nThe ISO15693 inventory helper removes a two-byte prefix without checking\nthat it exists, then accepts a one-byte remainder before reading data[1] as\nthe DSFID.\nRequire the prefix and at least two remaining bytes before copying the UID\ndata and reading the DSFID.", "A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. This vulnerability allows a Denial of Service (DoS) when the system encounters malformed wireless NFC responses. A nearby attacker with a crafted NFC device can transmit a truncated ISO 15693 inventory response, which the driver processes without verifying minimum length requirements. This causes an out-of-bounds memory read, leading to a kernel crash."], "name": "CVE-2026-98578", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98578\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98578\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98578.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7974728094d35f38775417a26d8f30ea3602496a,e47b2a350bb0ff123434ec5484c6dc3333b0727c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7974728094d35f38775417a26d8f30ea3602496a,57d183764f3002f9625ee4deeeb20716c519534e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7974728094d35f38775417a26d8f30ea3602496a,3af2ea4035581a1607d9830779c187a0c7e225aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7974728094d35f38775417a26d8f30ea3602496a,9fa21b0f78adb514e3bd96a505ddb752e9727ff3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7974728094d35f38775417a26d8f30ea3602496a,6353dae51bc9b3cad13c9d890b53311a46c96b4e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7974728094d35f38775417a26d8f30ea3602496a,fdd95e819d828c975aaeb258a3fed5dd7fd136d0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7974728094d35f38775417a26d8f30ea3602496a,a86987d03a4d39acdbe4533d83db4d656ea36c59)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7974728094d35f38775417a26d8f30ea3602496a,7f2ea5ed588c03d481f0301e6c3d4240132383fb)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:00:10.133939+00:00", "updated": "2026-10-22T22:00:15.037522+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}