CVE-2026-98482

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

nfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via

nfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path

only guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it

with pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs

-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb

tailroom. The byte becomes N(R)/N(S); a peer can already set those with

a well-formed PDU, so this is acting on uninitialised memory, not new

peer control.

Guard the read with pskb_may_pull(), as commit 95674f506c63 ("nfc: llcp:

reject PDUs shorter than the LLCP header") did for the two-byte header,

so the sequence byte is present and linear before it is read. RR and RNR

PDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is

longer, so no valid frame is rejected; a truncated PDU is malformed, so

re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References