{"id":"CVE-2026-98576","revision":"e34a528b0df14718930e9bf5efadbf0e","records":[{"revision":"e34a528b0df14718930e9bf5efadbf0e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98576","aliases":[],"title":"nfc: llcp: fix slab-out-of-bounds reads when logging service names","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix slab-out-of-bounds reads when logging service names\n\nnfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-\nterminated strings to pr_debug() using the %s format specifier.\nThe buffers are allocated via kmemdup() or come from netlink\nattributes and are not guaranteed to be null-terminated, causing\n__dynamic_pr_debug() to read beyond the allocated region:\n\n  KASAN: slab-out-of-bounds Read in __dynamic_pr_debug\n\nFix both call sites by using %.*s with the explicit length to limit\nthe output to the actual length of the string.","state":0,"publishedAt":"2026-10-18T15:18:41.629+00:00","modifiedAt":"2026-10-19T09:22:01.67+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/nfc/llcp_commands.c\",\n                        \"net/nfc/llcp_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d9b8d8e19b073096d3609bbd60f82148d128b555\",\n                            \"lessThan\": \"75f7c5a42fa1483f5912279a749417c284ad708f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d9b8d8e19b073096d3609bbd60f82148d128b555\",\n                            \"lessThan\": \"6d4ca872830e46fcca9c086bf19fa9bd2faf09d2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d9b8d8e19b073096d3609bbd60f82148d128b555\",\n                            \"lessThan\": \"a143f7835faa4fe0178448289feea4f84eeee8d6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d9b8d8e19b073096d3609bbd60f82148d128b555\",\n                            \"lessThan\": \"75bfd9ef4da2fb49dac1f19880d2ac4ccd07b45b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d9b8d8e19b073096d3609bbd60f82148d128b555\",\n                            \"lessThan\": \"8afb6c194f5781798d3ab3edf243cf5a24a9d1f9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d9b8d8e19b073096d3609bbd60f82148d128b555\",\n                            \"lessThan\": \"8978dff632519712d1fa432991e1f2e857f90239\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d9b8d8e19b073096d3609bbd60f82148d128b555\",\n                            \"lessThan\": \"4262b12277a3e056c95fc49e9c4d7bd97035d16c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d9b8d8e19b073096d3609bbd60f82148d128b555\",\n                            \"lessThan\": \"7dcf371a35632f035baf77bcf2c129165f772ce4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/nfc/llcp_commands.c\",\n                        \"net/nfc/llcp_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/75f7c5a42fa1483f5912279a749417c284ad708f","https://git.kernel.org/stable/c/6d4ca872830e46fcca9c086bf19fa9bd2faf09d2","https://git.kernel.org/stable/c/a143f7835faa4fe0178448289feea4f84eeee8d6","https://git.kernel.org/stable/c/75bfd9ef4da2fb49dac1f19880d2ac4ccd07b45b","https://git.kernel.org/stable/c/8afb6c194f5781798d3ab3edf243cf5a24a9d1f9","https://git.kernel.org/stable/c/8978dff632519712d1fa432991e1f2e857f90239","https://git.kernel.org/stable/c/4262b12277a3e056c95fc49e9c4d7bd97035d16c","https://git.kernel.org/stable/c/7dcf371a35632f035baf77bcf2c129165f772ce4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98576","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98576","identifiers":["CVE-2026-98576"]},"retained":false,"historicalAffected":[]}],"coverage":[]}