CVE-2026-98577

What it actually does

The nfc_llcp_wks_sap() function performs a prefix-only comparison of service names using strncmp() limited to the caller's provided length, allowing a short attacker-controlled name to match longer well-known service strings registered in the NFC LLCP stack.

Why it matters to the business

Attackers may intercept or hijack NFC peer-to-peer service connections on affected Linux systems, potentially disrupting short-range wireless communications or enabling unauthorized data access in NFC-enabled devices and embedded platforms.

How an attack unfolds

An attacker with the ability to initiate NFC LLCP connections supplies a short service name that matches the leading bytes of a target well-known service; because length is not validated before the prefix comparison, the kernel incorrectly routes the connection to the attacker's endpoint instead of the legitimate service.

How to fix it

Apply the upstream kernel patch that enforces an exact length check before performing the strncmp() comparison in nfc_llcp_wks_sap(); rebuild and deploy updated kernel images to all affected systems.

How to confirm the fix worked

Confirm the presence of the exact-length check (service_name_len == expected_len && strncmp(...)) in the nfc_llcp_wks_sap() function of the running kernel source or binary; test by attempting a short-name connection and verifying it is rejected.

Typical attack path

1. Establish NFC link with target device running vulnerable kernel
2. Send LLCP connection request using a short service_name that prefixes a registered WKS entry
3. Kernel matches via partial strncmp() and assigns the hijacked SAP
4. Attacker receives or manipulates subsequent LLCP traffic intended for the legitimate service

How to detect it

Examine kernel logs and NFC LLCP debug output for unexpected SAP assignments or service name mismatches; look for connection requests using unusually short service names in audit or driver traces.

What your security team should do

• Prioritize kernel updates on any systems exposing NFC LLCP interfaces
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict NFC functionality to only necessary devices until patched
• Review NFC-related code paths in custom or embedded Linux deployments