In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data… (CVE-2026-98481)

The Linux kernel's NFC port100 driver function port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums a length field (datalen) provided by the device. The datalen field is a 16-bit value supplied by the device and was not checked against the actual number of bytes received (urb->actual_length). Consequently, if a device reported a datalen larger than the actual received frame size, the port100_data_checksum() function could read out of bounds past the transfer buffer. The vulnerability was fixed by adding a check to reject any response whose declared frame size does not fit within the received length before performing validation.

This vulnerability could lead to out-of-bounds memory reads in the kernel space, potentially causing system instability or information disclosure. However, no known exploits are reported in the wild. The impact is limited to systems using the NFC port100 driver in the Linux kernel.

A fix has been implemented in the Linux kernel to reject frames where the declared length exceeds the received data length before validation. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation.