‹ Volver al listado

CVE-2026-98582

Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:

nfc: st21nfca: validate received frame size

st21nfca_hci_i2c_repack() recorta una trama recibida en su marcador EOF antes de eliminar el relleno de bytes (byte stuffing). A continuación, supone que la trama truncada contiene la cabecera LLC y dos bytes de CRC, y lee sin comprobación el byte que sigue a un marcador de escape.

Una trama malformada puede colocar el EOF inmediatamente después del marcador de inicio, o puede terminar su parte de datos con un marcador de escape. En el primer caso quedan muy pocos bytes para check_crc(), mientras que en el segundo el bucle de eliminación del relleno lee más allá de la longitud actual del skb.

Leer descripción completaMostrar menos

Se exige el mínimo de bytes de encuadre tanto antes como después de eliminar el relleno. Se usan cursores de entrada y de salida separados al eliminar el relleno de bytes, y se rechaza un marcador de escape sin su byte codificado. Así, las tramas malformadas permanecen dentro de los límites de la trama recibida antes del procesamiento de CRC.

Traducción automática del texto original de NVD (en inglés).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
0.21 %
Percentil entre todas las CVEs puntuadas
11
Fecha de la puntuación
20/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

Mostrar las 8 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98582",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "lessThan": "8934d2889ae16a7c77520e002398d0689c1ecea5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "lessThan": "d0596ee6c4b928a5c288790522a7495ee867da72",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "lessThan": "f526c218a149a30f110ce434ff17e033042404b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "lessThan": "d4008c3499dba7829bfe002edd99a8bff8ae3a7c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "lessThan": "91be5161f37b0a2795ad6806d69be5fa74522e5c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "lessThan": "57919d0662d8856211b794140172e51ca389f23d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "lessThan": "7b996cc06dda54c02a5aa607bda01109f0ac51e6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3096e25a3e40b73afd59e46f3bf8d84f919992a1",
              "lessThan": "a653c01ce447f10c36b901646888c0330363af4f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/nfc/st21nfca/i2c.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/nfc/st21nfca/i2c.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-18T16:17:10.743",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/57919d0662d8856211b794140172e51ca389f23d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7b996cc06dda54c02a5aa607bda01109f0ac51e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8934d2889ae16a7c77520e002398d0689c1ecea5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/91be5161f37b0a2795ad6806d69be5fa74522e5c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a653c01ce447f10c36b901646888c0330363af4f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d0596ee6c4b928a5c288790522a7495ee867da72",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d4008c3499dba7829bfe002edd99a8bff8ae3a7c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f526c218a149a30f110ce434ff17e033042404b8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate received frame size\n\nst21nfca_hci_i2c_repack() trims a received frame at its EOF marker\nbefore removing byte stuffing.  It then assumes the truncated frame\ncontains the LLC header and two CRC bytes, and it unconditionally reads\nthe byte after an escape marker.\n\nA malformed frame can place EOF immediately after the start marker or can\nend its data portion with an escape marker.  The former leaves too few\nbytes for check_crc(), while the latter makes the unstuffing loop read past\nthe current skb length.\n\nRequire the minimum framing bytes both before and after unstuffing.  Use\nseparate input and output cursors while removing byte stuffing, and reject\nan escape marker without its encoded byte.  This keeps malformed frames\nwithin the received frame boundary before CRC processing."
    }
  ],
  "lastModified": "2026-10-19T10:19:18.997",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}