VulnerabilityPublished 18 Oct 2026

CVE-2026-98480: Linux kernel · nfc: trf7970a: power down on startup RX gain failure

Source GCVE Database

Authoritative record:CVE-2026-98480· Low

Not known to be exploited · fixed in d2acbde7e67df44efa8f0963462d1192e7694ffc : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Low

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in d2acbde7e67df44efa8f0963462d1192e7694ffc, cc444e4ad43461374dd128573eccb8979d2adb4c, 6ef70d790425e76b42c69e416ee78c62bdc37d00

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-h99h-422h-66fh

What to do

Upgrade Linux kernel to d2acbde7e67df44efa8f0963462d1192e7694ffc, cc444e4ad43461374dd128573eccb8979d2adb4c or 6ef70d790425e76b42c69e416ee78c62bdc37d00.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5d69351820eab6be1d298af21aedd18be5e5a11a, < d2acbde7e67df44efa8f0963462d1192e7694ffc	Fixed in d2acbde7e67df44efa8f0963462d1192e7694ffc
LinuxLinux	Affected ≥ 5d69351820eab6be1d298af21aedd18be5e5a11a, < cc444e4ad43461374dd128573eccb8979d2adb4c	Fixed in cc444e4ad43461374dd128573eccb8979d2adb4c
LinuxLinux	Affected ≥ 5d69351820eab6be1d298af21aedd18be5e5a11a, < 6ef70d790425e76b42c69e416ee78c62bdc37d00	Fixed in 6ef70d790425e76b42c69e416ee78c62bdc37d00
LinuxLinux	Affected =6.17	Fixed in–
Debiandebian/linux`pkg:deb/debian/linux`Other threats	Affected =6.17	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix has been implemented in the Linux kernel to call trf7970a_power_down() on RX gain errors during startup, ensuring proper power-down and state restoration. Users should update to the kernel version containing this fix once it is released. No additional mitigation is indicated.

Description

A vulnerability in the Linux kernel's NFC driver for the trf7970a device was resolved. The issue occurs when the trf7970a_startup() function powers up the device before applying an optional RX gain reduction. If a register read or write fails, the function returns without powering down the device, leaving the device in an unintended powered-on state. This can cause unbalanced power references and improper device state management. The fix ensures that trf7970a_power_down() is called on error to properly deassert enable GPIOs and restore the powered-off state. The vulnerability was found during static analysis of kernel code.

Impact

The impact is improper power state management of the trf7970a NFC device in the Linux kernel, potentially leading to hardware being left powered on unintentionally. This could cause increased power consumption or hardware state inconsistencies. There is no indication of direct security compromise or exploitation in the wild.

Summary

The Linux kernel NFC driver for the trf7970a device had a flaw in the startup sequence where powering up the device occurred before applying RX gain reduction. If a register operation failed, the function would return without powering down, causing unbalanced power enable signals and leaving the device powered on incorrectly. The probe's unwind process did not address this additional power-up, and system resume also lacked power-down on this error path. The resolution involves calling trf7970a_power_down() before returning on RX gain error to properly release power references and disable GPIOs, preserving the original SPI error. This issue was identified through static analysis research.

References

Community reviews

Loading reviews…