CVE-2026-98576: nfc: llcp: fix slab-out-of-bounds reads when logging service names
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: fix slab-out-of-bounds reads when logging service names
nfcllcpwkssap() and nfcllcpbuildsdreqtlv() pass non-null- terminated strings to prdebug() using the %s format specifier. The buffers are allocated via kmemdup() or come from netlink attributes and are not guaranteed to be null-terminated, causing dynamicprdebug() to read beyond the allocated region:
KASAN: slab-out-of-bounds Read in dynamicprdebug
Fix both call sites by using %.s with the explicit length to limit the output to the actual length of the string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Fix both nfc call sites, nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv(), by replacing %s with %.*s and passing the explicit string length so logging is limited to the allocated buffer.
Event History
Frequently Asked Questions
What conditions are needed to trigger the out-of-bounds read?
The affected LLCP code must log a service name through nfc_llcp_wks_sap() or nfc_llcp_build_sdreq_tlv(). The issue occurs when those non-null-terminated service-name buffers are passed to pr_debug() with a %s format specifier.
How can I verify that a kernel contains the fix?
Check whether both nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() use a length-limited %.*s format when logging service names. The corrected calls provide the explicit string length rather than relying on null termination.
Is the affected data limited to one source of service names?
No. The affected service-name buffers may be allocated with kmemdup() or supplied through netlink attributes, and neither source guarantees null termination.