Cloudanix VulnDB

CVE-2026-98575

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in handling data from certain card readers could let a bad device peek at or crash parts of the computer's memory.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Unchecked datalen field from USB frame used as array index into frame->data[] causing out-of-bounds read in pn533_acr122_is_rx_frame_valid().

Why it matters to the business

Kernel memory disclosure or crash risk when attaching untrusted or malfunctioning ACR122-compatible NFC devices; low likelihood but affects any system exposing the pn533 driver.

How an attack unfolds

Attacker presents a malicious or rogue USB device that returns a crafted ACR122 frame containing an out-of-range datalen value; the driver reads this value directly and indexes past the end of the receive buffer.

How to fix it

Apply the upstream kernel patch that adds an explicit upper bound check on ccid.datalen against the maximum ACR122 frame size before any indexing.

How to confirm the fix worked

Confirm the bounds check on datalen exists in pn533_acr122_is_rx_frame_valid() and that the previous datalen == 0 test has been replaced.

Typical attack path

  1. Attach malicious USB NFC device
  2. Driver receives response frame and reads ccid.datalen unchecked
  3. OOB read occurs when indexing frame->data[]

How to detect it

Review kernel logs and USB device traces for pn533 driver faults or unexpected frame lengths during NFC device enumeration.

What your security team should do

  • Update to a kernel containing the pn533 bounds-check fix
  • Limit physical USB access for high-risk systems until patched
  • Monitor kernel logs for pn533-related oops or panics

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() frame->ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame->data[]. A malicious or malfunctioning device can set this field to an arbitrary value, causing the driver to read far outside the received buffer. Bound ccid.datalen against the maximum possible ACR122 frame size before using it. This replaces the existing datalen == 0 check, since datalen < 2 already covers that case and additionally rejects datalen == 1, which would still underflow the "datalen - 2" offset used below.

Affected packages

Ecosystem Package Introduced Fixed