CVE-2026-98481: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer. Reject a response whose declared frame size does not fit the received length before validating it. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.

Засегнати продукти

• Linux Linux: 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 преди 0d482995f0cdd0302450aa300c684c642d8ab31f; 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 преди 9e8df087826b9999d1b83b06f5d85675d5a69c9e; 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 преди db66a30588630c7de30ef033f00daddef69f6ad9; 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 преди 144ad477c381e2c592b64898d04ab4ce03b32861; 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 преди e4da1452e10c6472a4bac48dc2f6a35fff1fcd69; 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 преди 14b1467cfc6630583650f33538174c5a1ec685ab; 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 преди 035056e07ea65be670284246d9bc62f2f00ff4a3; 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 преди 092c6a605cbd6414ef499834c2e0da69c2c3388e
• Linux Linux: 3.13; преди 3.13; 5.10.271 до 5.10.*; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.112 до 6.12.*; 6.18.55 до 6.18.*; 7.2.9 до 7.2.*; от 7.3 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-98481
• https://nvd.nist.gov/vuln/detail/CVE-2026-98481
• https://git.kernel.org/stable/c/0d482995f0cdd0302450aa300c684c642d8ab31f
• https://git.kernel.org/stable/c/9e8df087826b9999d1b83b06f5d85675d5a69c9e
• https://git.kernel.org/stable/c/db66a30588630c7de30ef033f00daddef69f6ad9
• https://git.kernel.org/stable/c/144ad477c381e2c592b64898d04ab4ce03b32861
• https://git.kernel.org/stable/c/e4da1452e10c6472a4bac48dc2f6a35fff1fcd69
• https://git.kernel.org/stable/c/14b1467cfc6630583650f33538174c5a1ec685ab
• https://git.kernel.org/stable/c/035056e07ea65be670284246d9bc62f2f00ff4a3
• https://git.kernel.org/stable/c/092c6a605cbd6414ef499834c2e0da69c2c3388e