Cloudanix VulnDB

CVE-2026-98576

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel could let specially crafted network messages cause the system to read memory it should not during internal logging, risking crashes or data leaks on affected devices.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Non-null-terminated buffers from kmemdup or netlink attributes are passed to pr_debug with %s format specifier in nfc_llcp_wks_sap and nfc_llcp_build_sdreq_tlv, causing __dynamic_pr_debug to perform slab-out-of-bounds reads.

Why it matters to the business

Kernel memory corruption or information disclosure risk on systems using NFC LLCP, though limited to debug logging paths; low exploitation probability reduces urgency but still requires patching to maintain kernel stability.

How an attack unfolds

An attacker crafts a non-null-terminated service name via netlink or LLCP protocol messages; when the kernel logs it under debug conditions, the print function reads past the allocated buffer, potentially leaking kernel memory or triggering KASAN-detected faults.

How to fix it

Apply the upstream fix that replaces %s with %.*s using explicit buffer lengths in both call sites; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the updated source uses %.*s with length parameter in nfc_llcp_wks_sap and nfc_llcp_build_sdreq_tlv; run KASAN-enabled tests exercising LLCP service name logging.

Typical attack path

  1. Establish NFC LLCP connection or send SDREQ TLV with crafted service name
  2. Trigger kernel debug logging path for nfc_llcp_wks_sap or nfc_llcp_build_sdreq_tlv
  3. Cause out-of-bounds read during string formatting in __dynamic_pr_debug

How to detect it

Search kernel logs for KASAN slab-out-of-bounds Read reports mentioning __dynamic_pr_debug combined with nfc_llcp functions; inspect netlink or NFC LLCP traffic containing non-terminated strings.

What your security team should do

  • Prioritize kernel update on systems with NFC support enabled
  • Disable NFC LLCP if not required until patched
  • Monitor for kernel oops or KASAN reports involving __dynamic_pr_debug in NFC code

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null- terminated strings to pr_debug() using the %s format specifier. The buffers are allocated via kmemdup() or come from netlink attributes and are not guaranteed to be null-terminated, causing __dynamic_pr_debug() to read beyond the allocated region: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug Fix both call sites by using %.*s with the explicit length to limit the output to the actual length of the string.

Affected packages

Ecosystem Package Introduced Fixed