---
id: CVE-2026-98582
title: 'kernel: nfc: st21nfca: validate received frame size (CVE-2026-98582)'
summary: >-
  A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC)
  driver. The driver fails to properly validate the length of received frames
  when processing escape sequences. An attacker capable of sending crafted NFC
  frames …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <
    8934d2889ae16a7c77520e002398d0689c1ecea5
  - >-
    Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <
    d0596ee6c4b928a5c288790522a7495ee867da72
  - >-
    Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <
    f526c218a149a30f110ce434ff17e033042404b8
  - >-
    Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <
    d4008c3499dba7829bfe002edd99a8bff8ae3a7c
  - >-
    Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <
    91be5161f37b0a2795ad6806d69be5fa74522e5c
  - >-
    Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <
    57919d0662d8856211b794140172e51ca389f23d
  - >-
    Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <
    7b996cc06dda54c02a5aa607bda01109f0ac51e6
  - >-
    Linux >= 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <
    a653c01ce447f10c36b901646888c0330363af4f
  - Linux 3.16
published: '2026-10-18'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T04:08:53+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98582.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98582.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98582'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554910'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98582'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98582'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98582.mbox
  - url: 'https://git.kernel.org/stable/c/8934d2889ae16a7c77520e002398d0689c1ecea5'
  - url: 'https://git.kernel.org/stable/c/d0596ee6c4b928a5c288790522a7495ee867da72'
  - url: 'https://git.kernel.org/stable/c/f526c218a149a30f110ce434ff17e033042404b8'
  - url: 'https://git.kernel.org/stable/c/d4008c3499dba7829bfe002edd99a8bff8ae3a7c'
  - url: 'https://git.kernel.org/stable/c/91be5161f37b0a2795ad6806d69be5fa74522e5c'
  - url: 'https://git.kernel.org/stable/c/57919d0662d8856211b794140172e51ca389f23d'
  - url: 'https://git.kernel.org/stable/c/7b996cc06dda54c02a5aa607bda01109f0ac51e6'
  - url: 'https://git.kernel.org/stable/c/a653c01ce447f10c36b901646888c0330363af4f'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00216
epssPercentile: 0.11992
ingestedAt: '2026-10-18T15:45:12.253Z'
---

## Overview

A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames could exploit this vulnerability to trigger an out-of-bounds memory read, leading to a system crash and Denial of Service (DoS) or potential kernel memory disclosure.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98582.json)

**kernel: nfc: st21nfca: validate received frame size** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.