CVE-2026-98579

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

nfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested

netlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc

ENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was

already queued.

Route them through a new free_list label, mirroring the SDRES path in

the same file which already does this. Harmless on the success path

too -- send_snl_sdreq() drains the list as it moves nodes, so it's

already empty by the time free_list runs.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References