CVE-2026-98483 (GCVE-0-2026-98483)
Vulnerability from cvelistv5
Published
2026-10-18 15:15
Modified
2026-10-19 09:20
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc_get_local_general_bytes Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") attempted to fix a use-after-free (UAF) issue by invoking nfc_llcp_local_put(local) after accessing local->gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory. Fix this properly by refactoring nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer (out_gb) and its maximum length (gb_max_len). The general bytes are safely copied into out_gb before calling nfc_llcp_local_put(local), ensuring safe lifetime management without ownership transfer complications. Update all callers across drivers (microread, pn533, pn544, st21nfca, digital_dep, and nci) to provide their own destination buffers and pass them to nfc_get_local_general_bytes().
References
Impacted products
Vendor Product Version
Linux Linux Version: 96f2c6f272ec04083d828de46285a7d7b17d1aad
Version: fc8429f8d86801f092fbfbd257c3af821ac0dcd3
Version: 425d9d3a92df7d96b3cfb7ee5c240293a21cbde3
Version: 6709d4b7bc2e079241fdef15d1160581c5261c10
Version: 6709d4b7bc2e079241fdef15d1160581c5261c10
Version: 6709d4b7bc2e079241fdef15d1160581c5261c10
Version: 6709d4b7bc2e079241fdef15d1160581c5261c10
Version: 6709d4b7bc2e079241fdef15d1160581c5261c10
Version: dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548
Version: b3ad46e155a6d91b36c6e892019a43e3ef3c696d
Version: e5207c1d69b1a9707615ab6ff9376e59fc096815
Version: 5.10.188   ≤
Version: 5.15.121   ≤
Version: 6.1.39   ≤
Version: 5.4.251   ≤
Version: 6.3.13   ≤
Version: 6.4.4   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nfc/microread/microread.c",
            "drivers/nfc/pn533/pn533.c",
            "drivers/nfc/pn533/pn533.h",
            "drivers/nfc/pn544/pn544.c",
            "drivers/nfc/st21nfca/core.c",
            "include/net/nfc/hci.h",
            "include/net/nfc/nfc.h",
            "net/nfc/core.c",
            "net/nfc/digital_dep.c",
            "net/nfc/llcp_core.c",
            "net/nfc/nci/core.c",
            "net/nfc/nfc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25bfa673adc70189c0bc872940421ae59f789cf6",
              "status": "affected",
              "version": "96f2c6f272ec04083d828de46285a7d7b17d1aad",
              "versionType": "git"
            },
            {
              "lessThan": "2b31d0cc95856c856ada91f943fb14dfdf29a923",
              "status": "affected",
              "version": "fc8429f8d86801f092fbfbd257c3af821ac0dcd3",
              "versionType": "git"
            },
            {
              "lessThan": "c40f61a6a413f3eaf028e5fe367fd9749e503ab0",
              "status": "affected",
              "version": "425d9d3a92df7d96b3cfb7ee5c240293a21cbde3",
              "versionType": "git"
            },
            {
              "lessThan": "19bcfc2a56d0b82919079b5424c5a9a0ac897dcf",
              "status": "affected",
              "version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
              "versionType": "git"
            },
            {
              "lessThan": "d8c929e9afdbc33b1876ecb97a517e850449b5bd",
              "status": "affected",
              "version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
              "versionType": "git"
            },
            {
              "lessThan": "841af260ff477f6191872bc3b2e15488615c1827",
              "status": "affected",
              "version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
              "versionType": "git"
            },
            {
              "lessThan": "9ede11e12f965ace97c4e0f606667f24fb41e7e1",
              "status": "affected",
              "version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
              "versionType": "git"
            },
            {
              "lessThan": "dcab71a7011918f6fdba7adcec02d217dcb84b8d",
              "status": "affected",
              "version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b3ad46e155a6d91b36c6e892019a43e3ef3c696d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e5207c1d69b1a9707615ab6ff9376e59fc096815",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.271",
              "status": "affected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.222",
              "status": "affected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.189",
              "status": "affected",
              "version": "6.1.39",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.251",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nfc/microread/microread.c",
            "drivers/nfc/pn533/pn533.c",
            "drivers/nfc/pn533/pn533.h",
            "drivers/nfc/pn544/pn544.c",
            "drivers/nfc/st21nfca/core.c",
            "include/net/nfc/hci.h",
            "include/net/nfc/nfc.h",
            "net/nfc/core.c",
            "net/nfc/digital_dep.c",
            "net/nfc/llcp_core.c",
            "net/nfc/nci/core.c",
            "net/nfc/nfc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.10.188",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.15.121",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "6.1.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.251",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix use-after-free in nfc_get_local_general_bytes\n\nCommit 6709d4b7bc2e (\"net: nfc: Fix use-after-free caused by\nnfc_llcp_find_local\") attempted to fix a use-after-free (UAF) issue by\ninvoking nfc_llcp_local_put(local) after accessing local-\u003egb. However,\nif the reference count drops to zero, local is freed immediately,\nleading to a use-after-free when callers access the returned pointer.\nAlternative approaches using dynamic allocation (e.g. kmemdup) introduced\nmemory leaks because callers consistently treat the returned pointer as\nborrowed memory.\n\nFix this properly by refactoring nfc_llcp_general_bytes() and\nnfc_get_local_general_bytes() to accept a caller-provided output buffer\n(out_gb) and its maximum length (gb_max_len). The general bytes are\nsafely copied into out_gb before calling nfc_llcp_local_put(local),\nensuring safe lifetime management without ownership transfer complications.\n\nUpdate all callers across drivers (microread, pn533, pn544, st21nfca,\ndigital_dep, and nci) to provide their own destination buffers and pass\nthem to nfc_get_local_general_bytes()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:20:20.665Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923"
        },
        {
          "url": "https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0"
        },
        {
          "url": "https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d"
        }
      ],
      "title": "nfc: fix use-after-free in nfc_get_local_general_bytes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98483",
    "datePublished": "2026-10-18T15:15:57.275Z",
    "dateReserved": "2026-09-25T10:25:14.352Z",
    "dateUpdated": "2026-10-19T09:20:20.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.