CVE-2026-98575: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

Q: Who is exposed to this issue?

Systems using the Linux kernel PN533 NFC driver with an ACR122 device are exposed when the driver processes USB response frames from that device. A malicious or malfunctioning device can supply the crafted length field.

Q: What does an attacker need to exploit it?

An attacker needs to cause the driver to receive an ACR122 USB response frame whose ccid.datalen field has an invalid value. The unchecked value can be used as an index outside the received frame buffer.

Q: Are zero-length frames the only problematic input?

No. Values below 2 are invalid because the code uses a datalen - 2 offset, so a value of 1 can underflow that calculation. Excessively large values can also cause an out-of-bounds read.

Q: What is the remediation?

Apply a kernel update containing the fix that bounds ccid.datalen to the maximum possible ACR122 frame size before it is used. The fix also rejects values below 2.

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: fix OOB read in pn533acr122isrxframevalid()

frame->ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame->data[]. A malicious or malfunctioning device can set this field to an arbitrary value, causing the driver to read far outside the received buffer.

Bound ccid.datalen against the maximum possible ACR122 frame size before using it. This replaces the existing datalen == 0 check, since datalen < 2 already covers that case and additionally rejects datalen == 1, which would still underflow the "datalen - 2" offset used below.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:18 PM

Data Sourced

via MITRE·03:18 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Who is exposed to this issue?

Systems using the Linux kernel PN533 NFC driver with an ACR122 device are exposed when the driver processes USB response frames from that device. A malicious or malfunctioning device can supply the crafted length field.

What does an attacker need to exploit it?

An attacker needs to cause the driver to receive an ACR122 USB response frame whose ccid.datalen field has an invalid value. The unchecked value can be used as an index outside the received frame buffer.

Are zero-length frames the only problematic input?

No. Values below 2 are invalid because the code uses a datalen - 2 offset, so a value of 1 can underflow that calculation. Excessively large values can also cause an out-of-bounds read.

What is the remediation?

Apply a kernel update containing the fix that bounds ccid.datalen to the maximum possible ACR122 frame size before it is used. The fix also rejects values below 2.

CVE-2026-98575: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are zero-length frames the only problematic input?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are zero-length frames the only problematic input?

What is the remediation?