---
id: CVE-2026-98583
title: >-
  kernel: nfc: nfcmrvl: validate helper command length before pull
  (CVE-2026-98583)
summary: >-
  A flaw was found in the Linux kernel's Marvell NFC (Near Field Communication)
  driver. During firmware download operations, the driver removes packet headers
  and reads command data before verifying that the received packet length is
  valid. …
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 3194c6870158e305dac2af52f83681e9cb67280f <
    842c0603cfa49530ef081f181a2ddbba77a37231
  - >-
    Linux >= 3194c6870158e305dac2af52f83681e9cb67280f <
    e4b012240c8aaf57cec192234c24e0db5f531ffa
  - >-
    Linux >= 3194c6870158e305dac2af52f83681e9cb67280f <
    f15ad9d6e9173a037587dded77c904fdae8df380
  - >-
    Linux >= 3194c6870158e305dac2af52f83681e9cb67280f <
    a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9
  - >-
    Linux >= 3194c6870158e305dac2af52f83681e9cb67280f <
    4d4601e182c8567329be7d919669ec4d847ddd93
  - >-
    Linux >= 3194c6870158e305dac2af52f83681e9cb67280f <
    ed2e00bb22c73156bf8030b6204deabb25cf4eb5
  - >-
    Linux >= 3194c6870158e305dac2af52f83681e9cb67280f <
    6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c
  - >-
    Linux >= 3194c6870158e305dac2af52f83681e9cb67280f <
    686f942332b1667f13f3b8d6a2f50bcfbf42e277
  - Linux 4.4
published: '2026-10-18'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T04:08:55+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98583.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98583.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98583'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555011'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98583'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98583'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98583.mbox
  - url: 'https://git.kernel.org/stable/c/842c0603cfa49530ef081f181a2ddbba77a37231'
  - url: 'https://git.kernel.org/stable/c/e4b012240c8aaf57cec192234c24e0db5f531ffa'
  - url: 'https://git.kernel.org/stable/c/f15ad9d6e9173a037587dded77c904fdae8df380'
  - url: 'https://git.kernel.org/stable/c/a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9'
  - url: 'https://git.kernel.org/stable/c/4d4601e182c8567329be7d919669ec4d847ddd93'
  - url: 'https://git.kernel.org/stable/c/ed2e00bb22c73156bf8030b6204deabb25cf4eb5'
  - url: 'https://git.kernel.org/stable/c/6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c'
  - url: 'https://git.kernel.org/stable/c/686f942332b1667f13f3b8d6a2f50bcfbf42e277'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00216
epssPercentile: 0.11989
ingestedAt: '2026-10-18T15:45:12.252Z'
---

## Overview

A flaw was found in the Linux kernel's Marvell NFC (Near Field Communication) driver. During firmware download operations, the driver removes packet headers and reads command data before verifying that the received packet length is valid. An attacker could exploit this vulnerability by submitting a truncated frame, triggering an out-of-bounds memory read. This issue primarily results in a system crash and Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98583.json)

**kernel: nfc: nfcmrvl: validate helper command length before pull** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.