336 lines
16 KiB
JSON
336 lines
16 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-98483",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.352Z",
|
|
"datePublished": "2026-10-18T15:15:57.275Z",
|
|
"dateUpdated": "2026-10-19T09:20:20.665Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T09:20:20.665Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix use-after-free in nfc_get_local_general_bytes\n\nCommit 6709d4b7bc2e (\"net: nfc: Fix use-after-free caused by\nnfc_llcp_find_local\") attempted to fix a use-after-free (UAF) issue by\ninvoking nfc_llcp_local_put(local) after accessing local->gb. However,\nif the reference count drops to zero, local is freed immediately,\nleading to a use-after-free when callers access the returned pointer.\nAlternative approaches using dynamic allocation (e.g. kmemdup) introduced\nmemory leaks because callers consistently treat the returned pointer as\nborrowed memory.\n\nFix this properly by refactoring nfc_llcp_general_bytes() and\nnfc_get_local_general_bytes() to accept a caller-provided output buffer\n(out_gb) and its maximum length (gb_max_len). The general bytes are\nsafely copied into out_gb before calling nfc_llcp_local_put(local),\nensuring safe lifetime management without ownership transfer complications.\n\nUpdate all callers across drivers (microread, pn533, pn544, st21nfca,\ndigital_dep, and nci) to provide their own destination buffers and pass\nthem to nfc_get_local_general_bytes()."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/nfc/microread/microread.c",
|
|
"drivers/nfc/pn533/pn533.c",
|
|
"drivers/nfc/pn533/pn533.h",
|
|
"drivers/nfc/pn544/pn544.c",
|
|
"drivers/nfc/st21nfca/core.c",
|
|
"include/net/nfc/hci.h",
|
|
"include/net/nfc/nfc.h",
|
|
"net/nfc/core.c",
|
|
"net/nfc/digital_dep.c",
|
|
"net/nfc/llcp_core.c",
|
|
"net/nfc/nci/core.c",
|
|
"net/nfc/nfc.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "96f2c6f272ec04083d828de46285a7d7b17d1aad",
|
|
"lessThan": "25bfa673adc70189c0bc872940421ae59f789cf6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fc8429f8d86801f092fbfbd257c3af821ac0dcd3",
|
|
"lessThan": "2b31d0cc95856c856ada91f943fb14dfdf29a923",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "425d9d3a92df7d96b3cfb7ee5c240293a21cbde3",
|
|
"lessThan": "c40f61a6a413f3eaf028e5fe367fd9749e503ab0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
|
|
"lessThan": "19bcfc2a56d0b82919079b5424c5a9a0ac897dcf",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
|
|
"lessThan": "d8c929e9afdbc33b1876ecb97a517e850449b5bd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
|
|
"lessThan": "841af260ff477f6191872bc3b2e15488615c1827",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
|
|
"lessThan": "9ede11e12f965ace97c4e0f606667f24fb41e7e1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6709d4b7bc2e079241fdef15d1160581c5261c10",
|
|
"lessThan": "dcab71a7011918f6fdba7adcec02d217dcb84b8d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b3ad46e155a6d91b36c6e892019a43e3ef3c696d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e5207c1d69b1a9707615ab6ff9376e59fc096815",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5.10.188",
|
|
"lessThan": "5.10.271",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.121",
|
|
"lessThan": "5.15.222",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.39",
|
|
"lessThan": "6.1.189",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.251",
|
|
"lessThan": "5.5",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.13",
|
|
"lessThan": "6.4",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4.4",
|
|
"lessThan": "6.5",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/nfc/microread/microread.c",
|
|
"drivers/nfc/pn533/pn533.c",
|
|
"drivers/nfc/pn533/pn533.h",
|
|
"drivers/nfc/pn544/pn544.c",
|
|
"drivers/nfc/st21nfca/core.c",
|
|
"include/net/nfc/hci.h",
|
|
"include/net/nfc/nfc.h",
|
|
"net/nfc/core.c",
|
|
"net/nfc/digital_dep.c",
|
|
"net/nfc/llcp_core.c",
|
|
"net/nfc/nci/core.c",
|
|
"net/nfc/nfc.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.5",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.5",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.271",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.222",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.189",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.158",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.112",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.55",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.9",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.10.188",
|
|
"versionEndExcluding": "5.10.271"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15.121",
|
|
"versionEndExcluding": "5.15.222"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.1.39",
|
|
"versionEndExcluding": "6.1.189"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.6.158"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.12.112"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.18.55"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "7.2.9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "7.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.4.251"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.3.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.4.4"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d"
|
|
}
|
|
],
|
|
"title": "nfc: fix use-after-free in nfc_get_local_general_bytes",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |