CVE-2026-98481
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
nfc: port100: rechazar las tramas cuya longitud declarada supera los datos recibidos
port100_recv_response() pasa el búfer de transferencia de la URB a port100_rx_frame_is_valid(), que calcula la suma de comprobación de le16_to_cpu(frame->datalen) bytes de frame->data. datalen es un campo de 16 bits proporcionado por el dispositivo y nunca se comprueba frente al número de bytes realmente recibidos (urb->actual_length), de modo que un dispositivo que informe de un datalen mayor que la trama recibida hace que port100_data_checksum() lea fuera de límites, más allá del búfer de transferencia.
Leer descripción completaMostrar menos
Rechazar una respuesta cuyo tamaño de trama declarado no quepa en la longitud recibida antes de validarla.
Descubierta por 0sec (https://0sec.ai) mediante análisis automatizado del código fuente; el límite que falta es evidente en el código fuente. Probada únicamente a nivel de compilación.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/035056e07ea65be670284246d9bc62f2f00ff4a3
- https://git.kernel.org/stable/c/092c6a605cbd6414ef499834c2e0da69c2c3388e
- https://git.kernel.org/stable/c/0d482995f0cdd0302450aa300c684c642d8ab31f
- https://git.kernel.org/stable/c/144ad477c381e2c592b64898d04ab4ce03b32861
- https://git.kernel.org/stable/c/14b1467cfc6630583650f33538174c5a1ec685ab
- https://git.kernel.org/stable/c/9e8df087826b9999d1b83b06f5d85675d5a69c9e
- https://git.kernel.org/stable/c/db66a30588630c7de30ef033f00daddef69f6ad9
- https://git.kernel.org/stable/c/e4da1452e10c6472a4bac48dc2f6a35fff1fcd69
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98481",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06",
"lessThan": "0d482995f0cdd0302450aa300c684c642d8ab31f",
"versionType": "git"
},
{
"status": "affected",
"version": "562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06",
"lessThan": "9e8df087826b9999d1b83b06f5d85675d5a69c9e",
"versionType": "git"
},
{
"status": "affected",
"version": "562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06",
"lessThan": "db66a30588630c7de30ef033f00daddef69f6ad9",
"versionType": "git"
},
{
"status": "affected",
"version": "562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06",
"lessThan": "144ad477c381e2c592b64898d04ab4ce03b32861",
"versionType": "git"
},
{
"status": "affected",
"version": "562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06",
"lessThan": "e4da1452e10c6472a4bac48dc2f6a35fff1fcd69",
"versionType": "git"
},
{
"status": "affected",
"version": "562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06",
"lessThan": "14b1467cfc6630583650f33538174c5a1ec685ab",
"versionType": "git"
},
{
"status": "affected",
"version": "562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06",
"lessThan": "035056e07ea65be670284246d9bc62f2f00ff4a3",
"versionType": "git"
},
{
"status": "affected",
"version": "562d4d59b8a1d5f3ca75115d6ac10c7b7bc68c06",
"lessThan": "092c6a605cbd6414ef499834c2e0da69c2c3388e",
"versionType": "git"
}
],
"programFiles": [
"drivers/nfc/port100.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/nfc/port100.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:58.697",
"references": [
{
"url": "https://git.kernel.org/stable/c/035056e07ea65be670284246d9bc62f2f00ff4a3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/092c6a605cbd6414ef499834c2e0da69c2c3388e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0d482995f0cdd0302450aa300c684c642d8ab31f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/144ad477c381e2c592b64898d04ab4ce03b32861",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/14b1467cfc6630583650f33538174c5a1ec685ab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9e8df087826b9999d1b83b06f5d85675d5a69c9e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db66a30588630c7de30ef033f00daddef69f6ad9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e4da1452e10c6472a4bac48dc2f6a35fff1fcd69",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: port100: reject frames whose declared length exceeds the received data\n\nport100_recv_response() passes the URB transfer buffer to\nport100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen)\nbytes of frame->data. datalen is a 16-bit field supplied by the device\nand is never checked against the number of bytes actually received\n(urb->actual_length), so a device reporting a datalen larger than the\nreceived frame makes port100_data_checksum() read out of bounds past the\ntransfer buffer.\n\nReject a response whose declared frame size does not fit the received\nlength before validating it.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing bound is evident from source. Compile-tested."
}
],
"lastModified": "2026-10-19T10:18:59.333",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}