{"id":"CVE-2026-98481","title":"kernel: nfc: port100: reject frames whose declared length exceeds the received data (CVE-2026-98481)","summary":"A flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100 driver. An attacker connecting a malicious USB device can provide a response frame whose declared length exceeds the actual received data size. This flaw causes…","severity":"medium","cvss":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Linux","affected":["Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 < 0d482995f0cdd0302450aa300c684c642d8ab31f","Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 < 9e8df087826b9999d1b83b06f5d85675d5a69c9e","Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 < db66a30588630c7de30ef033f00daddef69f6ad9","Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 < 144ad477c381e2c592b64898d04ab4ce03b32861","Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 < e4da1452e10c6472a4bac48dc2f6a35fff1fcd69","Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 < 14b1467cfc6630583650f33538174c5a1ec685ab","Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 < 035056e07ea65be670284246d9bc62f2f00ff4a3","Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 < 092c6a605cbd6414ef499834c2e0da69c2c3388e","Linux 3.13"],"published":"2026-10-18","updated":"2026-10-20","sourceUpdated":"2026-10-20T11:40:46+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98481.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98481.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98481"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554858"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98481"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98481"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98481.mbox"},{"url":"https://git.kernel.org/stable/c/0d482995f0cdd0302450aa300c684c642d8ab31f"},{"url":"https://git.kernel.org/stable/c/9e8df087826b9999d1b83b06f5d85675d5a69c9e"},{"url":"https://git.kernel.org/stable/c/db66a30588630c7de30ef033f00daddef69f6ad9"},{"url":"https://git.kernel.org/stable/c/144ad477c381e2c592b64898d04ab4ce03b32861"},{"url":"https://git.kernel.org/stable/c/e4da1452e10c6472a4bac48dc2f6a35fff1fcd69"},{"url":"https://git.kernel.org/stable/c/14b1467cfc6630583650f33538174c5a1ec685ab"},{"url":"https://git.kernel.org/stable/c/035056e07ea65be670284246d9bc62f2f00ff4a3"},{"url":"https://git.kernel.org/stable/c/092c6a605cbd6414ef499834c2e0da69c2c3388e"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00216,"epssPercentile":0.1198,"ingestedAt":"2026-10-18T15:45:12.296Z","slug":"CVE-2026-98481","body":"## Overview\n\nA flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100 driver. An attacker connecting a malicious USB device can provide a response frame whose declared length exceeds the actual received data size. This flaw causes an out-of-bounds memory read during frame validation, which can lead to a system crash and a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98481.json)\n\n**kernel: nfc: port100: reject frames whose declared length exceeds the received data** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225501,"id":"CVE-2026-98481","ts":1792498272900,"field":"cvss","old":null,"new":"6.2"},{"seq":225500,"id":"CVE-2026-98481","ts":1792498272900,"field":"severity","old":"none","new":"medium"}]}