CVE-2026-98578: nfc: st21nfca: validate ISO15693 inventory length
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
nfc: st21nfca: validate ISO15693 inventory length
The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID.
Require the prefix and at least two remaining bytes before copying the UID data and reading the DSFID.
Affected Software
1 affected component
Linux Linux kernel
Event History
Oct 18, 2026
CVE Published
via MITRE·03:18 PM
Data Sourced
via MITRE·03:18 PM
Description
Data Sourced
via NVD·04:17 PM
Description