---
id: CVE-2026-98579
title: >-
  kernel: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
  (CVE-2026-98579)
summary: >-
  A flaw was found in the Linux kernel's NFC (Near Field Communication)
  subsystem. Error handling routines in the netlink interface fail to properly
  release allocated memory when processing service discovery requests encounters
  a failure. A …
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe: CWE-772
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= d9b8d8e19b073096d3609bbd60f82148d128b555 <
    5b1eca82085134bd92cd3810b0ef003c91e3f668
  - >-
    Linux >= d9b8d8e19b073096d3609bbd60f82148d128b555 <
    d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02
  - >-
    Linux >= d9b8d8e19b073096d3609bbd60f82148d128b555 <
    755bfc409748d8f3df64eb0eb26926270de3dd77
  - >-
    Linux >= d9b8d8e19b073096d3609bbd60f82148d128b555 <
    e43ec0191c1630f41e7043ac729ea6f1b8044a7f
  - >-
    Linux >= d9b8d8e19b073096d3609bbd60f82148d128b555 <
    08d2c069239ab425fdd333784a6a3b3e034e4aa0
  - >-
    Linux >= d9b8d8e19b073096d3609bbd60f82148d128b555 <
    cbde7f5d326172d6dbb55cca0df42fa7e1ed8115
  - >-
    Linux >= d9b8d8e19b073096d3609bbd60f82148d128b555 <
    0b01a946b0f234f5badd25968610b585a4895f08
  - >-
    Linux >= d9b8d8e19b073096d3609bbd60f82148d128b555 <
    66f4300206b82b0b143ef0d9be90cd8d29f23a47
  - Linux 3.10
published: '2026-10-18'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T03:49:44+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98579.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98579.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98579'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554908'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98579'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98579'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98579.mbox
  - url: 'https://git.kernel.org/stable/c/5b1eca82085134bd92cd3810b0ef003c91e3f668'
  - url: 'https://git.kernel.org/stable/c/d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02'
  - url: 'https://git.kernel.org/stable/c/755bfc409748d8f3df64eb0eb26926270de3dd77'
  - url: 'https://git.kernel.org/stable/c/e43ec0191c1630f41e7043ac729ea6f1b8044a7f'
  - url: 'https://git.kernel.org/stable/c/08d2c069239ab425fdd333784a6a3b3e034e4aa0'
  - url: 'https://git.kernel.org/stable/c/cbde7f5d326172d6dbb55cca0df42fa7e1ed8115'
  - url: 'https://git.kernel.org/stable/c/0b01a946b0f234f5badd25968610b585a4895f08'
  - url: 'https://git.kernel.org/stable/c/66f4300206b82b0b143ef0d9be90cd8d29f23a47'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00216
epssPercentile: 0.11997
ingestedAt: '2026-10-18T15:45:12.255Z'
---

## Overview

A flaw was found in the Linux kernel's NFC (Near Field Communication) subsystem. Error handling routines in the netlink interface fail to properly release allocated memory when processing service discovery requests encounters a failure. A local user can exploit this vulnerability by sending crafted requests to trigger these failure paths, causing kernel memory to leak. Repeated exploitation can exhaust available system memory, leading to a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Low · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98579.json)

**kernel: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure** — rated Low by Red Hat. Released 2026-10-18, updated 2026-10-20.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.