Answer in brief
CVE-2026-98481 records a Unknown severity vulnerability in nfc: port100: reject frames whose declared length exceeds the received data. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <0d482995f0cdd0302450aa300c684c642d8ab31f || >=562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <9e8df087826b9999d1b83b06f5d85675d5a69c9e || >=562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <db66a30588630c7de30ef033f00daddef69f6ad9 || >=562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <144ad477c381e2c592b64898d04ab4ce03b32861 || >=562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <e4da1452e10c6472a4bac48dc2f6a35fff1fcd69 || >=562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <14b1467cfc6630583650f33538174c5a1ec685ab || >=562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <035056e07ea65be670284246d9bc62f2f00ff4a3 || >=562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06 <092c6a605cbd6414ef499834c2e0da69c2c3388e | 0d482995f0cdd0302450aa300c684c642d8ab31f, 9e8df087826b9999d1b83b06f5d85675d5a69c9e, db66a30588630c7de30ef033f00daddef69f6ad9, 144ad477c381e2c592b64898d04ab4ce03b32861, e4da1452e10c6472a4bac48dc2f6a35fff1fcd69, 14b1467cfc6630583650f33538174c5a1ec685ab, 035056e07ea65be670284246d9bc62f2f00ff4a3, 092c6a605cbd6414ef499834c2e0da69c2c3388e |
| Linux/Linuxgeneric | 3.13 | Not reported |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer. Reject a response whose declared frame size does not fit the received length before validating it. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.
Quoted source text, attributed separately from HOL analysis.