CVE-2026-98576
Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null- terminated strings to pr_debug() using the %s format specifier. The buffers are allocated via kmemdup() or come from netlink attributes and are not guaranteed to be null-terminated, causing __dynamic_pr_debug() to read beyond the allocated region: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug Fix both call sites by using %.*s with the explicit length to limit the output to the actual length of the string.
How to fix
- Linux Linux75f7c5a42fa1483f5912279a749417c284ad708f, 6d4ca872830e46fcca9c086bf19fa9bd2faf09d2, a143f7835faa4fe0178448289feea4f84eeee8d6, 75bfd9ef4da2fb49dac1f19880d2ac4ccd07b45b, 8afb6c194f5781798d3ab3edf243cf5a24a9d1f9, 8978dff632519712d1fa432991e1f2e857f90239, 4262b12277a3e056c95fc49e9c4d7bd97035d16c, 7dcf371a35632f035baf77bcf2c129165f772ce4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | d9b8d8e19b073096d3609bbd60f82148d128b555 ≤ v < 75f7c5a42fa1483f5912279a749417c284ad708f, d9b8d8e19b073096d3609bbd60f82148d128b555 ≤ v < 6d4ca872830e46fcca9c086bf19fa9bd2faf09d2, d9b8d8e19b073096d3609bbd60f82148d128b555 ≤ v < a143f7835faa4fe0178448289feea4f84eeee8d6, d9b8d8e19b073096d3609bbd60f82148d128b555 ≤ v < 75bfd9ef4da2fb49dac1f19880d2ac4ccd07b45b, d9b8d8e19b073096d3609bbd60f82148d128b555 ≤ v < 8afb6c194f5781798d3ab3edf243cf5a24a9d1f9, d9b8d8e19b073096d3609bbd60f82148d128b555 ≤ v < 8978dff632519712d1fa432991e1f2e857f90239, d9b8d8e19b073096d3609bbd60f82148d128b555 ≤ v < 4262b12277a3e056c95fc49e9c4d7bd97035d16c, d9b8d8e19b073096d3609bbd60f82148d128b555 ≤ v < 7dcf371a35632f035baf77bcf2c129165f772ce4, 3.10 | 75f7c5a42fa1483f5912279a749417c284ad708f, 6d4ca872830e46fcca9c086bf19fa9bd2faf09d2, a143f7835faa4fe0178448289feea4f84eeee8d6, 75bfd9ef4da2fb49dac1f19880d2ac4ccd07b45b, 8afb6c194f5781798d3ab3edf243cf5a24a9d1f9, 8978dff632519712d1fa432991e1f2e857f90239, 4262b12277a3e056c95fc49e9c4d7bd97035d16c, 7dcf371a35632f035baf77bcf2c129165f772ce4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.