CVE-2026-98481nfc: port100: reject frames whose declared length exceeds the received data
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer. Reject a response whose declared frame size does not fit the received length before validating it. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.
Timeline
ID reserved
By Linux
- 23 days later
· 23 days later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 88% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 – < 0d482995f0cdd0302450aa300c684c642d8ab31f
- affected 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 – < 9e8df087826b9999d1b83b06f5d85675d5a69c9e
- affected 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 – < db66a30588630c7de30ef033f00daddef69f6ad9
- affected 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 – < 144ad477c381e2c592b64898d04ab4ce03b32861
- affected 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 – < e4da1452e10c6472a4bac48dc2f6a35fff1fcd69
- affected 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 – < 14b1467cfc6630583650f33538174c5a1ec685ab
- affected 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 – < 035056e07ea65be670284246d9bc62f2f00ff4a3
- affected 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 – < 092c6a605cbd6414ef499834c2e0da69c2c3388e
- affected 3.13
- unaffected < 3.13
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.55 – ≤ 6.18.*
- unaffected 7.2.9 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/0d482995f0cdd0302450aa300c684c642d8ab31f (opens in a new tab)
- https://git.kernel.org/stable/c/9e8df087826b9999d1b83b06f5d85675d5a69c9e (opens in a new tab)
- https://git.kernel.org/stable/c/db66a30588630c7de30ef033f00daddef69f6ad9 (opens in a new tab)
- https://git.kernel.org/stable/c/144ad477c381e2c592b64898d04ab4ce03b32861 (opens in a new tab)
- https://git.kernel.org/stable/c/e4da1452e10c6472a4bac48dc2f6a35fff1fcd69 (opens in a new tab)
- https://git.kernel.org/stable/c/14b1467cfc6630583650f33538174c5a1ec685ab (opens in a new tab)
- https://git.kernel.org/stable/c/035056e07ea65be670284246d9bc62f2f00ff4a3 (opens in a new tab)
- https://git.kernel.org/stable/c/092c6a605cbd6414ef499834c2e0da69c2c3388e (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-103721 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98481)Record last updated .