CVE-2026-98579

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98579", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.358Z", "datePublished": "2026-10-18T15:18:52.611Z", "dateUpdated": "2026-10-19T09:22:04.617Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:04.617Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure\n\nnfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested\nnetlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc\nENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was\nalready queued.\n\nRoute them through a new free_list label, mirroring the SDRES path in\nthe same file which already does this. Harmless on the success path\ntoo -- send_snl_sdreq() drains the list as it moves nodes, so it's\nalready empty by the time free_list runs."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/netlink.c"], "versions": [{"version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "lessThan": "5b1eca82085134bd92cd3810b0ef003c91e3f668", "status": "affected", "versionType": "git"}, {"version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "lessThan": "d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02", "status": "affected", "versionType": "git"}, {"version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "lessThan": "755bfc409748d8f3df64eb0eb26926270de3dd77", "status": "affected", "versionType": "git"}, {"version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "lessThan": "e43ec0191c1630f41e7043ac729ea6f1b8044a7f", "status": "affected", "versionType": "git"}, {"version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "lessThan": "08d2c069239ab425fdd333784a6a3b3e034e4aa0", "status": "affected", "versionType": "git"}, {"version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "lessThan": "cbde7f5d326172d6dbb55cca0df42fa7e1ed8115", "status": "affected", "versionType": "git"}, {"version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "lessThan": "0b01a946b0f234f5badd25968610b585a4895f08", "status": "affected", "versionType": "git"}, {"version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "lessThan": "66f4300206b82b0b143ef0d9be90cd8d29f23a47", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/netlink.c"], "versions": [{"version": "3.10", "status": "affected"}, {"version": "0", "lessThan": "3.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5b1eca82085134bd92cd3810b0ef003c91e3f668"}, {"url": "https://git.kernel.org/stable/c/d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02"}, {"url": "https://git.kernel.org/stable/c/755bfc409748d8f3df64eb0eb26926270de3dd77"}, {"url": "https://git.kernel.org/stable/c/e43ec0191c1630f41e7043ac729ea6f1b8044a7f"}, {"url": "https://git.kernel.org/stable/c/08d2c069239ab425fdd333784a6a3b3e034e4aa0"}, {"url": "https://git.kernel.org/stable/c/cbde7f5d326172d6dbb55cca0df42fa7e1ed8115"}, {"url": "https://git.kernel.org/stable/c/0b01a946b0f234f5badd25968610b585a4895f08"}, {"url": "https://git.kernel.org/stable/c/66f4300206b82b0b143ef0d9be90cd8d29f23a47"}], "title": "nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/nfc/netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5b1eca82085134bd92cd3810b0ef003c91e3f668", "status": "affected", "version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "versionType": "git"}, {"lessThan": "d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02", "status": "affected", "version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "versionType": "git"}, {"lessThan": "755bfc409748d8f3df64eb0eb26926270de3dd77", "status": "affected", "version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "versionType": "git"}, {"lessThan": "e43ec0191c1630f41e7043ac729ea6f1b8044a7f", "status": "affected", "version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "versionType": "git"}, {"lessThan": "08d2c069239ab425fdd333784a6a3b3e034e4aa0", "status": "affected", "version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "versionType": "git"}, {"lessThan": "cbde7f5d326172d6dbb55cca0df42fa7e1ed8115", "status": "affected", "version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "versionType": "git"}, {"lessThan": "0b01a946b0f234f5badd25968610b585a4895f08", "status": "affected", "version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "versionType": "git"}, {"lessThan": "66f4300206b82b0b143ef0d9be90cd8d29f23a47", "status": "affected", "version": "d9b8d8e19b073096d3609bbd60f82148d128b555", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/nfc/netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"lessThan": "3.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure\n\nnfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested\nnetlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc\nENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was\nalready queued.\n\nRoute them through a new free_list label, mirroring the SDRES path in\nthe same file which already does this. Harmless on the success path\ntoo -- send_snl_sdreq() drains the list as it moves nodes, so it's\nalready empty by the time free_list runs."}], "id": "CVE-2026-98579", "lastModified": "2026-10-19T10:19:18.453", "metrics": {}, "published": "2026-10-18T16:17:10.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/08d2c069239ab425fdd333784a6a3b3e034e4aa0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b01a946b0f234f5badd25968610b585a4895f08"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b1eca82085134bd92cd3810b0ef003c91e3f668"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/66f4300206b82b0b143ef0d9be90cd8d29f23a47"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/755bfc409748d8f3df64eb0eb26926270de3dd77"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cbde7f5d326172d6dbb55cca0df42fa7e1ed8115"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e43ec0191c1630f41e7043ac729ea6f1b8044a7f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure", "id": "2554908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554908"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure\nnfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested\nnetlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc\nENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was\nalready queued.\nRoute them through a new free_list label, mirroring the SDRES path in\nthe same file which already does this. Harmless on the success path\ntoo -- send_snl_sdreq() drains the list as it moves nodes, so it's\nalready empty by the time free_list runs.", "A flaw was found in the Linux kernel's NFC (Near Field Communication) subsystem. Error handling routines in the netlink interface fail to properly release allocated memory when processing service discovery requests encounters a failure. A local user can exploit this vulnerability by sending crafted requests to trigger these failure paths, causing kernel memory to leak. Repeated exploitation can exhaust available system memory, leading to a Denial of Service (DoS)."], "name": "CVE-2026-98579", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98579\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98579\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98579.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9b8d8e19b073096d3609bbd60f82148d128b555,5b1eca82085134bd92cd3810b0ef003c91e3f668)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9b8d8e19b073096d3609bbd60f82148d128b555,d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9b8d8e19b073096d3609bbd60f82148d128b555,755bfc409748d8f3df64eb0eb26926270de3dd77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9b8d8e19b073096d3609bbd60f82148d128b555,e43ec0191c1630f41e7043ac729ea6f1b8044a7f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9b8d8e19b073096d3609bbd60f82148d128b555,08d2c069239ab425fdd333784a6a3b3e034e4aa0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9b8d8e19b073096d3609bbd60f82148d128b555,cbde7f5d326172d6dbb55cca0df42fa7e1ed8115)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9b8d8e19b073096d3609bbd60f82148d128b555,0b01a946b0f234f5badd25968610b585a4895f08)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9b8d8e19b073096d3609bbd60f82148d128b555,66f4300206b82b0b143ef0d9be90cd8d29f23a47)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:15:14.328752+00:00", "updated": "2026-10-22T22:00:15.033504+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}