Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98578

nfc: st21nfca: validate ISO15693 inventory length

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID. Require the prefix and at least two remaining bytes before copying the UID data and reading the DSFID.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7974728094d35f38775417a26d8f30ea3602496a to < e47b2a350bb0ff123434ec5484c6dc3333b0727caffected
  • 7974728094d35f38775417a26d8f30ea3602496a to < 57d183764f3002f9625ee4deeeb20716c519534eaffected
  • 7974728094d35f38775417a26d8f30ea3602496a to < 3af2ea4035581a1607d9830779c187a0c7e225aaaffected
  • 7974728094d35f38775417a26d8f30ea3602496a to < 9fa21b0f78adb514e3bd96a505ddb752e9727ff3affected
  • 7974728094d35f38775417a26d8f30ea3602496a to < 6353dae51bc9b3cad13c9d890b53311a46c96b4eaffected
  • 7974728094d35f38775417a26d8f30ea3602496a to < fdd95e819d828c975aaeb258a3fed5dd7fd136d0affected
  • 7974728094d35f38775417a26d8f30ea3602496a to < a86987d03a4d39acdbe4533d83db4d656ea36c59affected
  • 7974728094d35f38775417a26d8f30ea3602496a to < 7f2ea5ed588c03d481f0301e6c3d4240132383fbaffected

Linux Linux

Default version status: affected

  • 3.16affected
  • 0 to < 3.16unaffected
  • 5.10.271 to ≤ 5.10.*unaffected
  • 5.15.222 to ≤ 5.15.*unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.55 to ≤ 6.18.*unaffected
  • 7.2.9 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References