In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download… (CVE-2026-98583)

The Linux kernel NFC driver (nfcmrvl) had a vulnerability where the firmware download receive path removed the NCI data header and read the helper command before validating the remaining packet length. This allowed a short or malformed frame to be accessed before being rejected, potentially leading to improper handling of malformed packets. The vulnerability was resolved by validating the full helper command length prior to stripping the NCI data header, preventing premature data access.

The vulnerability could allow malformed packets to be processed improperly by the NFC driver, which may lead to unexpected behavior or potential security issues in the kernel NFC subsystem. No specific exploitation details or impacts such as privilege escalation or denial of service are provided.

A fix has been applied to the Linux kernel to validate the complete helper command length before processing. Users should update to the fixed kernel version containing this patch. No additional mitigation steps are indicated.