In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()… (CVE-2026-98482)

The Linux kernel NFC LLCP receive handler (nfc_llcp_recv_hdlc()) previously read the sequence byte skb->data[2] before verifying the packet length, leading to reading uninitialized memory when processing truncated I, RR, or RNR PDUs. The receive path guarantees only a two-byte LLCP header, but the sequence byte is beyond that header. The vulnerability allows a peer to influence the sequence byte read from uninitialized tailroom memory, which is not new peer control data but uninitialized memory. The patch adds a pskb_may_pull() check to ensure the sequence byte is present and linear before reading it, dropping malformed truncated PDUs without replying with a DM frame.

This vulnerability results in the Linux kernel NFC LLCP handler reading uninitialized memory when processing truncated PDUs. While it does not involve new peer control data, it exposes uninitialized kernel memory contents, which may lead to information disclosure or undefined behavior. There is no indication of active exploitation in the wild.

A fix has been applied in the Linux kernel to add proper length checks before reading the sequence byte in nfc_llcp_recv_hdlc(). Users should update to the fixed kernel version containing commit 95674f506c63 or later. No additional mitigation is required as the vulnerability is addressed by this official fix.