In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names… (CVE-2026-98576)

The Linux kernel NFC LLCP code had a vulnerability where functions nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() passed non-null-terminated strings to pr_debug() using the %s format specifier. The strings originated from buffers allocated by kmemdup() or netlink attributes, which are not guaranteed to be null-terminated. This caused __dynamic_pr_debug() to perform slab-out-of-bounds reads, potentially leading to memory safety issues. The fix involved changing the debug print calls to use %.*s with explicit length parameters to prevent reading beyond the buffer boundaries.

The vulnerability could cause out-of-bounds memory reads in kernel debug logging, which may lead to kernel memory disclosure or instability. However, no known exploits in the wild have been reported. The impact is limited to kernel memory safety during debug logging of NFC LLCP service names.

A fix has been implemented in the Linux kernel source code to address this issue by properly bounding the debug output length. Users should apply the official kernel updates containing this fix when available. Patch status is not explicitly stated; check the vendor advisory for current remediation guidance.