In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() frame->ccid.datalen… (CVE-2026-98575)

The Linux kernel NFC driver for pn533 devices contained a vulnerability where the ccid.datalen field, read directly from a USB response frame, was used unchecked as an index into the frame->data array. This allowed a malicious or malfunctioning device to cause an out-of-bounds read by setting ccid.datalen to an arbitrary value. The fix involved bounding ccid.datalen against the maximum possible ACR122 frame size before usage, replacing the previous check for datalen == 0 with a stricter check that also rejects datalen == 1 to prevent underflow in subsequent calculations.

A malicious or malfunctioning NFC device could exploit this vulnerability to cause the Linux kernel driver to read memory outside the intended buffer, potentially leading to information disclosure or kernel instability. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to properly bound the ccid.datalen field before use, preventing out-of-bounds reads. Users should update their Linux kernel to a version that includes this fix. No additional mitigation steps are indicated by the vendor advisory.