CVE-2026-98582: nfc: st21nfca: validate received frame size
In the Linux kernel, the following vulnerability has been resolved:
nfc: st21nfca: validate received frame size
st21nfcahcii2crepack() trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it unconditionally reads the byte after an escape marker.
A malformed frame can place EOF immediately after the start marker or can end its data portion with an escape marker. The former leaves too few bytes for checkcrc(), while the latter makes the unstuffing loop read past the current skb length.
Require the minimum framing bytes both before and after unstuffing. Use separate input and output cursors while removing byte stuffing, and reject an escape marker without its encoded byte. This keeps malformed frames within the received frame boundary before CRC processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For Linux kernel nfc: st21nfca frame handling, require the minimum framing bytes both before and after byte unstuffing; keep separate input and output cursors while removing byte stuffing; reject frames that end with an escape marker without an encoded byte; and ensure frame-boundary checks occur before CRC processing.