Cloudanix VulnDB

CVE-2026-98583

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how some devices handle certain wireless data can let attackers cause crashes or unexpected problems by sending specially crafted signals from close by.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The firmware download receive path in the nfcmrvl NFC driver strips the NCI header and accesses the helper command payload before validating the remaining packet length, allowing a short or malformed frame to trigger data access on unvalidated input.

Why it matters to the business

Devices or systems using Linux kernel NFC functionality may experience crashes, unexpected behavior, or potential memory corruption when processing specially crafted wireless frames, increasing downtime and patching urgency for affected hardware.

How an attack unfolds

An attacker with the ability to send crafted NFC frames to a vulnerable kernel driver (for example via a nearby device or compromised firmware) supplies a short packet that bypasses length validation, reaching unsafe data access before the frame is rejected.

How to fix it

Apply the upstream kernel patch that moves the helper command length validation before NCI header stripping; update to a fixed kernel version containing the nfcmrvl change once released.

How to confirm the fix worked

Confirm the presence of the length validation check before header removal in the nfcmrvl firmware download receive path; test with crafted short packets to verify rejection occurs prior to data access.

Typical attack path

  1. Position a malicious NFC source within range of the target device
  2. Transmit a deliberately short or malformed helper command frame during firmware download handling
  3. Trigger the receive path that removes the NCI header before length validation
  4. Cause invalid memory access or kernel instability

How to detect it

Review kernel logs for nfcmrvl or NFC receive path errors, oops reports, or crashes triggered during firmware download handling; look for unexpected short NCI frames in driver debug output.

What your security team should do

  • Prioritize kernel updates for systems exposing NFC interfaces
  • Disable NFC functionality where not required until patched
  • Monitor vendor advisories for backported fixes in supported distributions

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach the data access before the malformed packet is rejected. Validate the complete helper command length before stripping the NCI data header.

Affected packages

Ecosystem Package Introduced Fixed