In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper… (CVE-2026-98578)

The Linux kernel NFC driver for st21nfca had a vulnerability where the ISO15693 inventory helper function improperly handled the length of the inventory data. Specifically, it removed a two-byte prefix without checking if it existed, then accepted a one-byte remainder before reading the DSFID from data[1]. This could lead to incorrect processing of NFC inventory data. The vulnerability was addressed by enforcing the presence of the prefix and requiring at least two remaining bytes before copying UID data and reading the DSFID.

Improper validation of the ISO15693 inventory length could lead to incorrect handling of NFC data within the kernel. While the exact impact is not detailed, such flaws could potentially cause kernel memory corruption or unexpected behavior when processing NFC inventory data. There is no indication of known exploitation in the wild.

A fix has been applied in the Linux kernel to validate the ISO15693 inventory length properly. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel update from the vendor or distribution is the recommended remediation.