CVE-2026-98482
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
nfc: llcp: descartar las PDU I/RR/RNR truncadas en nfc_llcp_recv_hdlc()
nfc_llcp_recv_hdlc() lee el byte de secuencia skb->data[2], mediante nfc_llcp_ns()/nfc_llcp_nr(), antes de realizar cualquier comprobación de longitud. La ruta de recepción solo garantiza la cabecera LLCP de dos bytes: __nfc_llcp_recv() la comprueba con pskb_may_pull() y nfc_llcp_recv_agf() admite PDU internas de dos bytes; por tanto, una PDU I, RR o RNR de dos bytes lee un byte del espacio libre (tailroom) no inicializado del skb.
Leer descripción completaMostrar menos
Ese byte se convierte en N(R)/N(S); un par ya puede establecer esos valores con una PDU bien formada, por lo que aquí se actúa sobre memoria no inicializada y no se trata de un nuevo control por parte del par.
Proteger la lectura con pskb_may_pull(), tal como hizo el commit 95674f506c63 ("nfc: llcp: reject PDUs shorter than the LLCP header") para la cabecera de dos bytes, de forma que el byte de secuencia esté presente y sea lineal antes de leerlo. Las PDU RR y RNR miden LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes y una PDU I es más larga, por lo que no se rechaza ningún marco válido; una PDU truncada está mal formada, así que se retorna sin enviar una respuesta DM.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/066205553a0106565bcede934f5721c25ebd6e4e
- https://git.kernel.org/stable/c/18f60ee882403d5b48097f5f6ae45f794e4cc643
- https://git.kernel.org/stable/c/273f9d667cde649f8de9d72b1303cc2f4b658c50
- https://git.kernel.org/stable/c/3afdbebfee2ef7e9510880868cfb482cbffe6836
- https://git.kernel.org/stable/c/51b6d73373589abb9de4d84767b0db1bc8d395d9
- https://git.kernel.org/stable/c/744e61bd06188d8bb068c26a461c252f242b05c9
- https://git.kernel.org/stable/c/810f204ef8f61f0c930cf6b3280050b3ee6a8ae7
- https://git.kernel.org/stable/c/9b4086eb67a9a3b1ce69fef1b6793827363703ce
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98482",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
"lessThan": "3afdbebfee2ef7e9510880868cfb482cbffe6836",
"versionType": "git"
},
{
"status": "affected",
"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
"lessThan": "9b4086eb67a9a3b1ce69fef1b6793827363703ce",
"versionType": "git"
},
{
"status": "affected",
"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
"lessThan": "51b6d73373589abb9de4d84767b0db1bc8d395d9",
"versionType": "git"
},
{
"status": "affected",
"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
"lessThan": "066205553a0106565bcede934f5721c25ebd6e4e",
"versionType": "git"
},
{
"status": "affected",
"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
"lessThan": "18f60ee882403d5b48097f5f6ae45f794e4cc643",
"versionType": "git"
},
{
"status": "affected",
"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
"lessThan": "810f204ef8f61f0c930cf6b3280050b3ee6a8ae7",
"versionType": "git"
},
{
"status": "affected",
"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
"lessThan": "744e61bd06188d8bb068c26a461c252f242b05c9",
"versionType": "git"
},
{
"status": "affected",
"version": "d646960f7986fefb460a2b062d5ccc8ccfeacc3a",
"lessThan": "273f9d667cde649f8de9d72b1303cc2f4b658c50",
"versionType": "git"
}
],
"programFiles": [
"net/nfc/llcp_core.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/nfc/llcp_core.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:58.817",
"references": [
{
"url": "https://git.kernel.org/stable/c/066205553a0106565bcede934f5721c25ebd6e4e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/18f60ee882403d5b48097f5f6ae45f794e4cc643",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/273f9d667cde649f8de9d72b1303cc2f4b658c50",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3afdbebfee2ef7e9510880868cfb482cbffe6836",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/51b6d73373589abb9de4d84767b0db1bc8d395d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/744e61bd06188d8bb068c26a461c252f242b05c9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/810f204ef8f61f0c930cf6b3280050b3ee6a8ae7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9b4086eb67a9a3b1ce69fef1b6793827363703ce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()\n\nnfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via\nnfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path\nonly guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it\nwith pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs\n-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb\ntailroom. The byte becomes N(R)/N(S); a peer can already set those with\na well-formed PDU, so this is acting on uninitialised memory, not new\npeer control.\n\nGuard the read with pskb_may_pull(), as commit 95674f506c63 (\"nfc: llcp:\nreject PDUs shorter than the LLCP header\") did for the two-byte header,\nso the sequence byte is present and linear before it is read. RR and RNR\nPDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is\nlonger, so no valid frame is rejected; a truncated PDU is malformed, so\nreturn without a DM reply."
}
],
"lastModified": "2026-10-19T10:18:59.507",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}