CVE-2026-98579

kernel: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

Loading…

Severity

Low

Red Hat Product Security

3.3

CVSS 3.1

Review impact separately from score.

Published · October 18, 2026

Updated · October 20, 2026

Description

A flaw was found in the Linux kernel's NFC (Near Field Communication) subsystem. Error handling routines in the netlink interface fail to properly release allocated memory when processing service discovery requests encounters a failure. A local user can exploit this vulnerability by sending crafted requests to trigger these failure paths, causing kernel memory to leak. Repeated exploitation can exhaust available system memory, leading to a Denial of Service (DoS).

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 3.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-772 · Missing Release of Resource after Effective Lifetime