CVE-2026-98582: Linux kernel · nfc: st21nfca: validate received frame size
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f526c218a149a30f110ce434ff17e033042404b8 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 13:47 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f526c218a149a30f110ce434ff17e033042404b8, d4008c3499dba7829bfe002edd99a8bff8ae3a7c, d0596ee6c4b928a5c288790522a7495ee867da72 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
This vulnerability has been fixed in the Linux kernel. Users should apply the official patches or upgrade to a fixed kernel version containing the commits identified by the fixedVersions hashes. No additional mitigation is required once the fix is applied.
Description
A vulnerability in the Linux kernel NFC driver for st21nfca allows malformed frames to bypass proper size validation, potentially causing out-of-bounds reads during frame processing. The issue arises because the code assumes a minimum frame size and unconditionally reads bytes after escape markers without verifying boundaries. This flaw has been fixed by enforcing minimum framing byte requirements and improving byte-stuffing removal logic.
References
- git.kernel.org/stable/c/8934d2889ae16a7c77520e002398d0689c1ecea5 (opens in a new tab)
- git.kernel.org/stable/c/d0596ee6c4b928a5c288790522a7495ee867da72 (opens in a new tab)
- git.kernel.org/stable/c/f526c218a149a30f110ce434ff17e033042404b8 (opens in a new tab)
- git.kernel.org/stable/c/d4008c3499dba7829bfe002edd99a8bff8ae3a7c (opens in a new tab)
- git.kernel.org/stable/c/91be5161f37b0a2795ad6806d69be5fa74522e5c (opens in a new tab)
- git.kernel.org/stable/c/57919d0662d8856211b794140172e51ca389f23d (opens in a new tab)
- git.kernel.org/stable/c/7b996cc06dda54c02a5aa607bda01109f0ac51e6 (opens in a new tab)
- git.kernel.org/stable/c/a653c01ce447f10c36b901646888c0330363af4f (opens in a new tab)