CVE-2026-98578 — nfc: st21nfca: validate ISO15693 inventory length
In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix w…
Published: 2026-10-18 · CVSS: Unscored
In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID. Require the prefix and at least two remaining bytes before copying the UID data and reading the DSFID.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7