In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc_get_local_general_bytes Commit 6709d4b7bc2e… (CVE-2026-98483)

The vulnerability (CVE-2026-98483) in the Linux kernel NFC subsystem was caused by a use-after-free in the function nfc_get_local_general_bytes. A previous fix attempted to release a reference after accessing local->gb, but if the reference count dropped to zero, the local object was freed immediately, causing use-after-free when callers accessed the returned pointer. Attempts to fix this with dynamic allocation caused memory leaks due to callers treating the pointer as borrowed memory. The proper fix refactored nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept caller-provided output buffers and safely copy the general bytes before releasing the local reference, ensuring safe lifetime management without ownership transfer issues. All affected drivers were updated accordingly.

The vulnerability could lead to use-after-free conditions in the NFC subsystem of the Linux kernel, potentially causing kernel crashes or memory corruption. No specific exploitation details or active exploits are reported.

A fix has been implemented in the Linux kernel by refactoring the affected NFC functions to use caller-provided buffers and safe copying before releasing references. Users should update to the fixed Linux kernel version containing this patch. No additional mitigation steps are indicated.