CVE-2026-98481: nfc: port100: reject frames whose declared length exceeds the received data

CVE-2026-98481: nfc: port100: reject frames whose declared length exceeds the received data

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nfc: port100: reject frames whose declared length exceeds the received data

port100_recv_response() passes the URB transfer buffer to
port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen)
bytes of frame->data. datalen is a 16-bit field supplied by the device
and is never checked against the number of bytes actually received
(urb->actual_length), so a device reporting a datalen larger than the
received frame makes port100_data_checksum() read out of bounds past the
transfer buffer.

Reject a response whose declared frame size does not fit the received
length before validating it.

Found by 0sec (https://0sec.ai) using automated source analysis; the
missing bound is evident from source. Compile-tested.

The Linux kernel CVE team has assigned CVE-2026-98481 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 5.10.271 with commit 0d482995f0cdd0302450aa300c684c642d8ab31f
	Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 5.15.222 with commit 9e8df087826b9999d1b83b06f5d85675d5a69c9e
	Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 6.1.189 with commit db66a30588630c7de30ef033f00daddef69f6ad9
	Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 6.6.158 with commit 144ad477c381e2c592b64898d04ab4ce03b32861
	Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 6.12.112 with commit e4da1452e10c6472a4bac48dc2f6a35fff1fcd69
	Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 6.18.55 with commit 14b1467cfc6630583650f33538174c5a1ec685ab
	Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 7.2.9 with commit 035056e07ea65be670284246d9bc62f2f00ff4a3
	Issue introduced in 3.13 with commit 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 and fixed in 7.3-rc5 with commit 092c6a605cbd6414ef499834c2e0da69c2c3388e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98481
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nfc/port100.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0d482995f0cdd0302450aa300c684c642d8ab31f
	https://git.kernel.org/stable/c/9e8df087826b9999d1b83b06f5d85675d5a69c9e
	https://git.kernel.org/stable/c/db66a30588630c7de30ef033f00daddef69f6ad9
	https://git.kernel.org/stable/c/144ad477c381e2c592b64898d04ab4ce03b32861
	https://git.kernel.org/stable/c/e4da1452e10c6472a4bac48dc2f6a35fff1fcd69
	https://git.kernel.org/stable/c/14b1467cfc6630583650f33538174c5a1ec685ab
	https://git.kernel.org/stable/c/035056e07ea65be670284246d9bc62f2f00ff4a3
	https://git.kernel.org/stable/c/092c6a605cbd6414ef499834c2e0da69c2c3388e