Cloudanix VulnDB

CVE-2026-98481

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing check in the Linux kernel's NFC driver could let specially crafted hardware responses read or crash kernel memory.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in port100_recv_response when a device-supplied 16-bit datalen exceeds urb->actual_length, causing port100_data_checksum to access memory past the URB transfer buffer.

Why it matters to the business

Kernel memory disclosure or crash on systems using the port100 NFC driver, potentially leading to denial of service or limited information exposure; low immediate risk given hardware prerequisite and absence from known exploitation lists.

How an attack unfolds

An attacker supplies a malicious NFC response frame via compromised or emulated port100 hardware where the declared datalen is larger than the actual bytes received; the unchecked value causes the checksum routine to read past the allocated buffer.

How to fix it

Apply the upstream fix that adds an explicit length check rejecting frames whose declared size exceeds received data before checksum validation; rebuild and deploy updated kernel packages containing the patch.

How to confirm the fix worked

Confirm the presence of the length-validation check in port100_rx_frame_is_valid or port100_recv_response in the running kernel source or binary; test with a fuzzer or modified device that supplies oversized datalen values and verify the frame is now rejected.

Typical attack path

  1. Obtain or emulate port100 NFC hardware capable of sending crafted URB responses
  2. Send a frame whose le16 datalen field exceeds the actual transfer length
  3. Trigger port100_recv_response to invoke the unchecked checksum over the oversized declared range
  4. Observe kernel oops or read kernel memory contents via the resulting out-of-bounds access

How to detect it

Search kernel logs for oops or warning messages originating from port100_data_checksum or port100_rx_frame_is_valid; inspect dmesg and audit logs for unexpected NFC URB handling errors shortly after device insertion or NFC activity.

What your security team should do

  • Prioritize kernel updates on any system exposing the port100 NFC driver within the next patching cycle
  • Disable the nfc/port100 module via modprobe blacklist if NFC functionality is not required
  • Monitor upstream stable kernel releases for backports of the length check
  • Review device firmware and drivers for similar unchecked length fields supplied by hardware

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer. Reject a response whose declared frame size does not fit the received length before validating it. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.

Affected packages

Ecosystem Package Introduced Fixed