CVE-2026-98483
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
nfc: fix use-after-free in nfc_get_local_general_bytes
El commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") intentó corregir un problema de use-after-free (UAF) invocando nfc_llcp_local_put(local) después de acceder a local->gb. Sin embargo, si el contador de referencias llega a cero, local se libera inmediatamente, lo que provoca un use-after-free cuando los llamantes acceden al puntero devuelto. Otros enfoques basados en asignación dinámica (p. ej., kmemdup) introdujeron fugas de memoria, porque los llamantes tratan sistemáticamente el puntero devuelto como memoria prestada.
Leer descripción completaMostrar menos
Corregir esto de forma adecuada refactorizando nfc_llcp_general_bytes() y nfc_get_local_general_bytes() para que acepten un búfer de salida proporcionado por el llamante (out_gb) y su longitud máxima (gb_max_len). Los bytes generales se copian de forma segura en out_gb antes de llamar a nfc_llcp_local_put(local), garantizando una gestión segura del ciclo de vida sin complicaciones de transferencia de propiedad.
Actualizar todos los llamantes en los controladores (microread, pn533, pn544, st21nfca, digital_dep y nci) para que proporcionen sus propios búferes de destino y los pasen a nfc_get_local_general_bytes().
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf
- https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6
- https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923
- https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827
- https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1
- https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0
- https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd
- https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98483",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "96f2c6f272ec04083d828de46285a7d7b17d1aad",
"lessThan": "25bfa673adc70189c0bc872940421ae59f789cf6",
"versionType": "git"
},
{
"status": "affected",
"version": "fc8429f8d86801f092fbfbd257c3af821ac0dcd3",
"lessThan": "2b31d0cc95856c856ada91f943fb14dfdf29a923",
"versionType": "git"
},
{
"status": "affected",
"version": "425d9d3a92df7d96b3cfb7ee5c240293a21cbde3",
"lessThan": "c40f61a6a413f3eaf028e5fe367fd9749e503ab0",
"versionType": "git"
},
{
"status": "affected",
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
"lessThan": "19bcfc2a56d0b82919079b5424c5a9a0ac897dcf",
"versionType": "git"
},
{
"status": "affected",
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
"lessThan": "d8c929e9afdbc33b1876ecb97a517e850449b5bd",
"versionType": "git"
},
{
"status": "affected",
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
"lessThan": "841af260ff477f6191872bc3b2e15488615c1827",
"versionType": "git"
},
{
"status": "affected",
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
"lessThan": "9ede11e12f965ace97c4e0f606667f24fb41e7e1",
"versionType": "git"
},
{
"status": "affected",
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
"lessThan": "dcab71a7011918f6fdba7adcec02d217dcb84b8d",
"versionType": "git"
},
{
"status": "affected",
"version": "dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548",
"versionType": "git"
},
{
"status": "affected",
"version": "b3ad46e155a6d91b36c6e892019a43e3ef3c696d",
"versionType": "git"
},
{
"status": "affected",
"version": "e5207c1d69b1a9707615ab6ff9376e59fc096815",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.188",
"lessThan": "5.10.271",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.121",
"lessThan": "5.15.222",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.39",
"lessThan": "6.1.189",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.251",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.3.13",
"lessThan": "6.4",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.4.4",
"lessThan": "6.5",
"versionType": "semver"
}
],
"programFiles": [
"drivers/nfc/microread/microread.c",
"drivers/nfc/pn533/pn533.c",
"drivers/nfc/pn533/pn533.h",
"drivers/nfc/pn544/pn544.c",
"drivers/nfc/st21nfca/core.c",
"include/net/nfc/hci.h",
"include/net/nfc/nfc.h",
"net/nfc/core.c",
"net/nfc/digital_dep.c",
"net/nfc/llcp_core.c",
"net/nfc/nci/core.c",
"net/nfc/nfc.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/nfc/microread/microread.c",
"drivers/nfc/pn533/pn533.c",
"drivers/nfc/pn533/pn533.h",
"drivers/nfc/pn544/pn544.c",
"drivers/nfc/st21nfca/core.c",
"include/net/nfc/hci.h",
"include/net/nfc/nfc.h",
"net/nfc/core.c",
"net/nfc/digital_dep.c",
"net/nfc/llcp_core.c",
"net/nfc/nci/core.c",
"net/nfc/nfc.h"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:58.940",
"references": [
{
"url": "https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix use-after-free in nfc_get_local_general_bytes\n\nCommit 6709d4b7bc2e (\"net: nfc: Fix use-after-free caused by\nnfc_llcp_find_local\") attempted to fix a use-after-free (UAF) issue by\ninvoking nfc_llcp_local_put(local) after accessing local->gb. However,\nif the reference count drops to zero, local is freed immediately,\nleading to a use-after-free when callers access the returned pointer.\nAlternative approaches using dynamic allocation (e.g. kmemdup) introduced\nmemory leaks because callers consistently treat the returned pointer as\nborrowed memory.\n\nFix this properly by refactoring nfc_llcp_general_bytes() and\nnfc_get_local_general_bytes() to accept a caller-provided output buffer\n(out_gb) and its maximum length (gb_max_len). The general bytes are\nsafely copied into out_gb before calling nfc_llcp_local_put(local),\nensuring safe lifetime management without ownership transfer complications.\n\nUpdate all callers across drivers (microread, pn533, pn544, st21nfca,\ndigital_dep, and nci) to provide their own destination buffers and pass\nthem to nfc_get_local_general_bytes()."
}
],
"lastModified": "2026-10-19T10:18:59.677",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}