{"id":"CVE-2026-98582","title":"kernel: nfc: st21nfca: validate received frame size (CVE-2026-98582)","summary":"A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Linux","affected":["Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 < 8934d2889ae16a7c77520e002398d0689c1ecea5","Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 < d0596ee6c4b928a5c288790522a7495ee867da72","Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 < f526c218a149a30f110ce434ff17e033042404b8","Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 < d4008c3499dba7829bfe002edd99a8bff8ae3a7c","Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 < 91be5161f37b0a2795ad6806d69be5fa74522e5c","Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 < 57919d0662d8856211b794140172e51ca389f23d","Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 < 7b996cc06dda54c02a5aa607bda01109f0ac51e6","Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 < a653c01ce447f10c36b901646888c0330363af4f","Linux 3.16"],"published":"2026-10-18","updated":"2026-10-20","sourceUpdated":"2026-10-20T04:08:53+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98582.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98582.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98582"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554910"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98582"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98582"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98582.mbox"},{"url":"https://git.kernel.org/stable/c/8934d2889ae16a7c77520e002398d0689c1ecea5"},{"url":"https://git.kernel.org/stable/c/d0596ee6c4b928a5c288790522a7495ee867da72"},{"url":"https://git.kernel.org/stable/c/f526c218a149a30f110ce434ff17e033042404b8"},{"url":"https://git.kernel.org/stable/c/d4008c3499dba7829bfe002edd99a8bff8ae3a7c"},{"url":"https://git.kernel.org/stable/c/91be5161f37b0a2795ad6806d69be5fa74522e5c"},{"url":"https://git.kernel.org/stable/c/57919d0662d8856211b794140172e51ca389f23d"},{"url":"https://git.kernel.org/stable/c/7b996cc06dda54c02a5aa607bda01109f0ac51e6"},{"url":"https://git.kernel.org/stable/c/a653c01ce447f10c36b901646888c0330363af4f"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00216,"epssPercentile":0.11992,"ingestedAt":"2026-10-18T15:45:12.253Z","slug":"CVE-2026-98582","body":"## Overview\n\nA flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames could exploit this vulnerability to trigger an out-of-bounds memory read, leading to a system crash and Denial of Service (DoS) or potential kernel memory disclosure.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98582.json)\n\n**kernel: nfc: st21nfca: validate received frame size** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225757,"id":"CVE-2026-98582","ts":1792498434623,"field":"cvss","old":null,"new":"6.5"},{"seq":225756,"id":"CVE-2026-98582","ts":1792498434623,"field":"severity","old":"none","new":"medium"}]}