---
id: CVE-2026-98481
title: >-
  kernel: nfc: port100: reject frames whose declared length exceeds the received
  data (CVE-2026-98481)
summary: >-
  A flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100
  driver. An attacker connecting a malicious USB device can provide a response
  frame whose declared length exceeds the actual received data size. This flaw
  causes…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <
    0d482995f0cdd0302450aa300c684c642d8ab31f
  - >-
    Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <
    9e8df087826b9999d1b83b06f5d85675d5a69c9e
  - >-
    Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <
    db66a30588630c7de30ef033f00daddef69f6ad9
  - >-
    Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <
    144ad477c381e2c592b64898d04ab4ce03b32861
  - >-
    Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <
    e4da1452e10c6472a4bac48dc2f6a35fff1fcd69
  - >-
    Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <
    14b1467cfc6630583650f33538174c5a1ec685ab
  - >-
    Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <
    035056e07ea65be670284246d9bc62f2f00ff4a3
  - >-
    Linux >= 562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <
    092c6a605cbd6414ef499834c2e0da69c2c3388e
  - Linux 3.13
published: '2026-10-18'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T11:40:46+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98481.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98481.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98481'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554858'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98481'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98481'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98481.mbox
  - url: 'https://git.kernel.org/stable/c/0d482995f0cdd0302450aa300c684c642d8ab31f'
  - url: 'https://git.kernel.org/stable/c/9e8df087826b9999d1b83b06f5d85675d5a69c9e'
  - url: 'https://git.kernel.org/stable/c/db66a30588630c7de30ef033f00daddef69f6ad9'
  - url: 'https://git.kernel.org/stable/c/144ad477c381e2c592b64898d04ab4ce03b32861'
  - url: 'https://git.kernel.org/stable/c/e4da1452e10c6472a4bac48dc2f6a35fff1fcd69'
  - url: 'https://git.kernel.org/stable/c/14b1467cfc6630583650f33538174c5a1ec685ab'
  - url: 'https://git.kernel.org/stable/c/035056e07ea65be670284246d9bc62f2f00ff4a3'
  - url: 'https://git.kernel.org/stable/c/092c6a605cbd6414ef499834c2e0da69c2c3388e'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00216
epssPercentile: 0.1198
ingestedAt: '2026-10-18T15:45:12.296Z'
---

## Overview

A flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100 driver. An attacker connecting a malicious USB device can provide a response frame whose declared length exceeds the actual received data size. This flaw causes an out-of-bounds memory read during frame validation, which can lead to a system crash and a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98481.json)

**kernel: nfc: port100: reject frames whose declared length exceeds the received data** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.