CVE-2026-98577: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap()
nfcllcpwkssap() compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length match before strncmp().
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Require the service name length to exactly match the WKS string length before calling strncmp() in nfc_llcp_wks_sap(), preventing short names from matching longer WKS strings by prefix.
Linux kernel NFC LLCP service name length validation = exact length match
Event History
Oct 18, 2026
CVE Published
via MITRE·03:18 PM
Data Sourced
via MITRE·03:18 PM
Description
Data Sourced
via NVD·04:17 PM
Description