CVE-2026-98576

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix slab-out-of-bounds reads when logging service names

nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-

terminated strings to pr_debug() using the %s format specifier.

The buffers are allocated via kmemdup() or come from netlink

attributes and are not guaranteed to be null-terminated, causing

__dynamic_pr_debug() to read beyond the allocated region:

KASAN: slab-out-of-bounds Read in __dynamic_pr_debug

Fix both call sites by using %.*s with the explicit length to limit

the output to the actual length of the string.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References