CVE-2026-98483: nfc: fix use-after-free in nfc_get_local_general_bytes
In the Linux kernel, the following vulnerability has been resolved:
nfc: fix use-after-free in nfcgetlocalgeneralbytes
Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfcllcpfindlocal") attempted to fix a use-after-free (UAF) issue by invoking nfcllcplocalput(local) after accessing local->gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory.
Fix this properly by refactoring nfcllcpgeneralbytes() and nfcgetlocalgeneralbytes() to accept a caller-provided output buffer (outgb) and its maximum length (gbmaxlen). The general bytes are safely copied into outgb before calling nfcllcplocalput(local), ensuring safe lifetime management without ownership transfer complications.
Update all callers across drivers (microread, pn533, pn544, st21nfca, digitaldep, and nci) to provide their own destination buffers and pass them to nfcgetlocalgeneralbytes().
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel NFC subsystem may be exposed, particularly where the updated NFC driver paths are used: microread, pn533, pn544, st21nfca, digital_dep, and nci.
What condition leads to the use-after-free?
The issue occurs when nfc_get_local_general_bytes() returns a pointer to local general bytes after dropping the local object's reference. If that reference drop frees the object, a caller that accesses the returned borrowed pointer dereferences freed memory.
How is the issue fixed?
The corrected implementation has callers supply an output buffer and maximum length. The kernel copies the general bytes into that caller-owned buffer before releasing the local object, so no pointer into freed memory is returned.
What should be done if immediate patching is not possible?
The provided information does not identify a configuration workaround. Reducing or disabling use of affected NFC functionality and drivers can limit exposure until a kernel containing the referenced fixes is deployed.