Cloudanix VulnDB

CVE-2026-98579

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small mistake in the Linux kernel's NFC code can slowly leak memory when certain error conditions occur, which may eventually make the system unstable if the NFC feature is used repeatedly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak of TLV list nodes in nfc_genl_llc_sdreq() when nested netlink attribute parsing, TLV allocation, or nfc_llcp_send_snl_sdreq() fails; error paths bypass the free_list cleanup that the success path and the SDRES counterpart already use.

Why it matters to the business

Repeated triggering of the affected NFC LLCP netlink code paths can gradually exhaust kernel memory, causing performance degradation or denial of service on systems that expose NFC functionality.

How an attack unfolds

An attacker with local netlink access crafts malformed nested attributes for NFC LLCP SDREQ messages; on any of the three documented error paths the allocated TLV nodes are never freed, and repeated invocations accumulate the leak until memory pressure becomes noticeable.

How to fix it

Apply the upstream fix that routes all three error paths through the free_list label; update to a Linux kernel release that contains the patch for CVE-2026-98579.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds the free_list label and drains the list on the SDREQ error paths; inspect nfc_llcp.c for the mirrored SDRES cleanup pattern.

Typical attack path

  1. Obtain local access capable of sending netlink messages to the NFC generic netlink family
  2. Send a sequence of SDREQ messages that hit parse failure, allocation failure, or send failure
  3. Repeat to amplify the TLV list leak without triggering the success-path drain
  4. Monitor for kernel memory pressure or OOM conditions

How to detect it

Review kernel memory usage trends and slab allocator statistics for unexpected growth in NFC-related objects; audit netlink audit logs for unusual volumes of NFC LLCP SDREQ messages from untrusted processes.

What your security team should do

  • Prioritize kernel updates on systems that compile or load the NFC LLCP module
  • Disable NFC netlink interfaces via kernel configuration or module blacklisting where NFC is unused
  • Monitor EPSS and exploit maturity; currently low but re-evaluate after publication

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc ENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was already queued. Route them through a new free_list label, mirroring the SDRES path in the same file which already does this. Harmless on the success path too -- send_snl_sdreq() drains the list as it moves nodes, so it's already empty by the time free_list runs.

Affected packages

Ecosystem Package Introduced Fixed