In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure… (CVE-2026-98579)

CVE-2026-98579 addresses a memory leak in the Linux kernel's NFC LLCP implementation. Specifically, the function nfc_genl_llc_sdreq() builds a list of TLV nodes while parsing nested netlink attributes. On three error paths—nested attribute parse failure, TLV allocation failure due to ENOMEM, and failure in nfc_llcp_send_snl_sdreq()—the code failed to free already allocated TLV nodes, causing a memory leak. The fix routes these error paths through a new free_list label to ensure proper cleanup. The normal success path is unaffected as send_snl_sdreq() drains the list during operation.

The vulnerability causes a memory leak in the kernel's NFC LLCP code on specific error conditions. This could lead to increased memory usage and potential resource exhaustion if triggered repeatedly. There is no indication of direct code execution or privilege escalation impact.

A fix has been applied to the Linux kernel to properly free allocated TLV nodes on error paths in the NFC LLCP code. Users should update to the fixed kernel version once available. No additional mitigation is required as the issue is resolved in the kernel source.