Cloudanix VulnDB

CVE-2026-98483

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's handling of near-field communication data could let an attacker crash devices or gain elevated access on systems that use NFC.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in nfc_llcp_general_bytes and nfc_get_local_general_bytes caused by premature nfc_llcp_local_put freeing the local structure before callers finish accessing the returned gb pointer.

Why it matters to the business

Kernel memory corruption or crashes on NFC-enabled Linux systems can lead to denial of service or potential privilege escalation, affecting embedded devices, mobile handsets, and servers using NFC stacks.

How an attack unfolds

An attacker with local or adjacent NFC access triggers repeated LLCP general bytes queries while racing the reference count drop, causing the freed local object to be dereferenced and potentially controlled for arbitrary read/write or code execution.

How to fix it

Apply the upstream fix that refactors nfc_llcp_general_bytes and nfc_get_local_general_bytes to accept caller-supplied output buffers, then rebuild and deploy the patched kernel; update all NFC drivers (microread, pn533, pn544, st21nfca, digital_dep, nci) accordingly.

How to confirm the fix worked

Verify the presence of the refactored function signatures accepting out_gb and gb_max_len parameters; confirm no callers receive a borrowed pointer that could outlive the local object; test NFC stack initialization and general bytes retrieval under load.

Typical attack path

  1. Obtain local or NFC-adjacent access to target
  2. Initiate NFC discovery or LLCP session setup
  3. Force repeated calls to nfc_get_local_general_bytes while manipulating reference counts
  4. Trigger use-after-free by accessing the dangling gb pointer after nfc_llcp_local_put
  5. Leverage resulting memory corruption for privilege escalation or crash

How to detect it

Search kernel logs and dmesg for NFC LLCP use-after-free warnings, slab object reuse messages, or panics referencing nfc_llcp_local; inspect crash dumps for dangling pointers returned from nfc_get_local_general_bytes; correlate with NFC interface activity in audit logs.

  • nfc_llcp_find_local
  • nfc_get_local_general_bytes
  • use-after-free in nfc
  • nfc_llcp_local_put

What your security team should do

  • Prioritize kernel update on all systems exposing NFC interfaces within the next maintenance window
  • Disable NFC kernel modules on non-essential systems until patched
  • Monitor for NFC-related kernel oops and slab corruption reports
  • Review downstream device firmware images that bundle vulnerable NFC drivers

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc_get_local_general_bytes Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") attempted to fix a use-after-free (UAF) issue by invoking nfc_llcp_local_put(local) after accessing local->gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory. Fix this properly by refactoring nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer (out_gb) and its maximum length (gb_max_len). The general bytes are safely copied into out_gb before calling nfc_llcp_local_put(local), ensuring safe lifetime management without ownership transfer complications. Update all callers across drivers (microread, pn533, pn544, st21nfca, digital_dep, and nci) to provide their own destination buffers and pass them to nfc_get_local_general_bytes().

Affected packages

Ecosystem Package Introduced Fixed