From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB926490BE2 for ; Sun, 18 Oct 2026 15:21:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792336884; cv=none; b=VV0tG4OHbj9vfAsIQkzGwNO+DvGIl1bkLQlxGsIgfigu56pEOlpij0vRccKlapeXpxJL1QVM7hdVaY8xolfKGUcOd0ljefWJlSU5nIlp/XIiD+z9bMU5MWKZK/sQ2zwTKnwz27NtTj3H5Rh4z3DepGJZp/7zwdQUgodk20YBFmg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792336884; c=relaxed/simple; bh=KnSyQVEnHDQ7cEensYpDP2bH7qqPueRTRJ2hhbNjMpM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YKDaGYr5m/RMOsZlbk080UnTwMDGmHv7kOEuLh4Yi21ar5O0eiZ8jznKpw/X18XQipvhN9iUD3/X5TvLYnW65vkvSZcfiO1F6bJhERhYAcDK2LRezYAFNUBbCollXllnnsfu4EyUgcDqdrT4a1vvQKolzKiPSzCpNOYRbtNEoa4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AEYB0G9M; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="AEYB0G9M" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1EC961F000C4; Sun, 18 Oct 2026 15:21:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792336882; bh=LM3atMU5sX6gmueGEEE+tHLTfPNRVcg2ZO1TE2Z18cw=; h=From:To:Cc:Subject:Date:Reply-To; b=AEYB0G9Mko3Q17lucLKU5WA06M6Rk9qSbr4c+RMnAvDyN6mPcnRHqHpS8EvkhfhrE BMBlhagI2u9rtaJnHY+YQwvC4jhRNqqWFL5NRnVA/5B+nI2w1CiDIyvr+ib52pJiQx f/kNkHwUggTT/EoOlPIfArtBQxaGDhiClXHa/9jY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98481: nfc: port100: reject frames whose declared length exceeds the received data Date: Sun, 18 Oct 2026 17:15:45 +0200 Message-ID: <2026101814-CVE-2026-98481-003e@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3823; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=503v5m7bFW2McQVF2rSR/4YVWcKXZZ1KdTClgRlzLF8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHjXl/bLvrDBOPLx0u16VmbjXp2aHyxYTl0x4rPTnz f7gcyq+HbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR44sZFkxzU526cqbNw72l 6ds+5vNJ6ZxZbcKwYCb/nh/t/v9jL0/ZL6t1zWLDlcWf7gMA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer. Reject a response whose declared frame size does not fit the received length before validating it. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested. The Linux kernel CVE team has assigned CVE-2026-98481 to this issue. Affected and fixed versions =========================== Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 5.10.271 with commit 0d482995f0cdd0302450aa300c684c642d8ab31f Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 5.15.222 with commit 9e8df087826b9999d1b83b06f5d85675d5a69c9e Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 6.1.189 with commit db66a30588630c7de30ef033f00daddef69f6ad9 Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 6.6.158 with commit 144ad477c381e2c592b64898d04ab4ce03b32861 Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 6.12.112 with commit e4da1452e10c6472a4bac48dc2f6a35fff1fcd69 Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 6.18.55 with commit 14b1467cfc6630583650f33538174c5a1ec685ab Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 7.2.9 with commit 035056e07ea65be670284246d9bc62f2f00ff4a3 Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 7.3-rc5 with commit 092c6a605cbd6414ef499834c2e0da69c2c3388e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98481 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nfc/port100.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/0d482995f0cdd0302450aa300c684c642d8ab31f https://git.kernel.org/stable/c/9e8df087826b9999d1b83b06f5d85675d5a69c9e https://git.kernel.org/stable/c/db66a30588630c7de30ef033f00daddef69f6ad9 https://git.kernel.org/stable/c/144ad477c381e2c592b64898d04ab4ce03b32861 https://git.kernel.org/stable/c/e4da1452e10c6472a4bac48dc2f6a35fff1fcd69 https://git.kernel.org/stable/c/14b1467cfc6630583650f33538174c5a1ec685ab https://git.kernel.org/stable/c/035056e07ea65be670284246d9bc62f2f00ff4a3 https://git.kernel.org/stable/c/092c6a605cbd6414ef499834c2e0da69c2c3388e