Cloudanix VulnDB

CVE-2026-98582

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how some Linux systems handle wireless card frames could let attackers crash the device or peek at protected memory.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient input validation in st21nfca_hci_i2c_repack allows malformed NFC frames to trigger out-of-bounds reads during byte unstuffing or insufficient data for CRC checks.

Why it matters to the business

May cause kernel crashes, denial of service, or limited memory disclosure on Linux systems using ST21NFCA NFC hardware, increasing downtime risk for connected devices.

How an attack unfolds

An attacker sends a crafted NFC frame over I2C that places the EOF marker too early or ends with an unmatched escape byte, causing the repack function to read past the skb buffer during unstuffing or CRC validation.

How to fix it

Apply the upstream kernel patch requiring minimum framing bytes before and after unstuffing, separate input/output cursors, and rejection of lone escape markers.

How to confirm the fix worked

Confirm the patched st21nfca_hci_i2c_repack function contains explicit minimum-length checks and dual-cursor logic in the kernel source tree.

Typical attack path

  1. Craft NFC frame with EOF immediately after start marker or trailing escape without data byte
  2. Transmit frame via I2C to the ST21NFCA controller
  3. Invoke st21nfca_hci_i2c_repack on receipt
  4. Trigger out-of-bounds access in unstuffing loop or check_crc

How to detect it

Review kernel ring buffer and dmesg for st21nfca module crashes, skb over-read warnings, or unexpected frame size errors following NFC activity.

What your security team should do

  • Update to a kernel containing the frame validation fix
  • Disable NFC hardware if unused on affected devices
  • Monitor kernel logs for st21nfca oops or frame processing warnings

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it unconditionally reads the byte after an escape marker. A malformed frame can place EOF immediately after the start marker or can end its data portion with an escape marker. The former leaves too few bytes for check_crc(), while the latter makes the unstuffing loop read past the current skb length. Require the minimum framing bytes both before and after unstuffing. Use separate input and output cursors while removing byte stuffing, and reject an escape marker without its encoded byte. This keeps malformed frames within the received frame boundary before CRC processing.

Affected packages

Ecosystem Package Introduced Fixed