In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca_hci_i2c_repack() trims a… (CVE-2026-98582)

The Linux kernel NFC driver for the ST21NFCA chip contained a vulnerability in the st21nfca_hci_i2c_repack() function. This function trims a received frame at its EOF marker before removing byte stuffing and assumes the truncated frame contains the LLC header and two CRC bytes. It unconditionally reads the byte after an escape marker, which can lead to out-of-bounds reads if a malformed frame places EOF immediately after the start marker or ends with an escape marker. The fix requires minimum framing bytes before and after unstuffing, uses separate cursors for input and output during byte unstuffing, and rejects escape markers without their encoded byte, preventing malformed frames from causing buffer overreads during CRC processing.

Malformed NFC frames can cause the vulnerable function to read beyond the allocated buffer, potentially leading to memory corruption. This could affect kernel stability or security depending on how the corrupted memory is used. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel NFC driver to validate frame sizes properly and safely handle byte unstuffing. Users should apply the official kernel updates that include this patch to remediate the vulnerability.