Cloudanix VulnDB

CVE-2026-98578

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles certain NFC card responses could let an attacker crash the system or leak memory by using a specially crafted card.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing length validation in the ISO15693 inventory handler allows removal of a two-byte prefix and access to data[1] without ensuring sufficient input bytes exist, resulting in out-of-bounds read.

Why it matters to the business

Systems using NFC readers with the st21nfca driver may experience kernel crashes or memory disclosure when processing malformed inventory responses from nearby NFC tags.

How an attack unfolds

An attacker presents a malicious ISO15693 tag that returns a truncated inventory response; the kernel helper blindly strips the expected prefix and indexes into insufficient data, triggering the flaw.

How to fix it

Apply the upstream kernel patch that enforces minimum length checks before prefix removal and DSFID/UID processing; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm the patch is present by inspecting the st21nfca ISO15693 inventory function for the added length requirements on prefix and remaining bytes.

Typical attack path

  1. Position malicious ISO15693 tag near affected NFC reader
  2. Kernel invokes st21nfca inventory helper on received response
  3. Helper removes two-byte prefix without length check
  4. Short remainder causes invalid data[1] access for DSFID and UID copy

How to detect it

Review kernel logs for oops or panic entries originating from st21nfca during NFC inventory operations; correlate with recent NFC tag interactions.

What your security team should do

  • Prioritize kernel update on any system exposing NFC readers within the next patch cycle
  • Monitor upstream stable branches for the backported fix
  • Limit NFC functionality to trusted environments until patched

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID. Require the prefix and at least two remaining bytes before copying the UID data and reading the DSFID.

Affected packages

Ecosystem Package Introduced Fixed