CVE-2026-98575
kernel: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 18, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's PN533 NFC (Near Field Communication) driver. An attacker capable of connecting a malicious or malfunctioning USB device can supply a crafted response frame with an arbitrary data length value. Because the driver fails to validate this length against maximum frame boundaries before indexing the buffer, an out-of-bounds read occurs, potentially causing a Denial of Service (DoS) via system crash or disclosing sensitive kernel memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-125 · Out-of-bounds Read