CVE-2026-98578

Impact

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID. Require the prefix and at least two remaining bytes before copying the UID data and reading the DSFID.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

References

• NVD record
• CVE.org record
• https://git.kernel.org/stable/c/3af2ea4035581a1607d9830779c187a0c7e225aa
• https://git.kernel.org/stable/c/57d183764f3002f9625ee4deeeb20716c519534e
• https://git.kernel.org/stable/c/6353dae51bc9b3cad13c9d890b53311a46c96b4e
• https://git.kernel.org/stable/c/7f2ea5ed588c03d481f0301e6c3d4240132383fb
• https://git.kernel.org/stable/c/9fa21b0f78adb514e3bd96a505ddb752e9727ff3
• https://git.kernel.org/stable/c/a86987d03a4d39acdbe4533d83db4d656ea36c59
• https://git.kernel.org/stable/c/e47b2a350bb0ff123434ec5484c6dc3333b0727c
• https://git.kernel.org/stable/c/fdd95e819d828c975aaeb258a3fed5dd7fd136d0