nfc: nfcmrvl: validate helper command length before pull
Summary
| CVE | CVE-2026-98583 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-10-18 16:17:10 UTC |
|---|
| Updated | 2026-10-19 10:19:19 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
nfc: nfcmrvl: validate helper command length before pull
The firmware download receive path removes the NCI data header and
reads the helper command before validating the remaining packet length.
A short frame can therefore reach the data access before the malformed
packet is rejected.
Validate the complete helper command length before stripping the NCI
data header. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 3194c6870158e305dac2af52f83681e9cb67280f 842c0603cfa49530ef081f181a2ddbba77a37231 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3194c6870158e305dac2af52f83681e9cb67280f e4b012240c8aaf57cec192234c24e0db5f531ffa git |
Not specified |
| CNA |
Linux |
Linux |
affected 3194c6870158e305dac2af52f83681e9cb67280f f15ad9d6e9173a037587dded77c904fdae8df380 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3194c6870158e305dac2af52f83681e9cb67280f a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3194c6870158e305dac2af52f83681e9cb67280f 4d4601e182c8567329be7d919669ec4d847ddd93 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3194c6870158e305dac2af52f83681e9cb67280f ed2e00bb22c73156bf8030b6204deabb25cf4eb5 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3194c6870158e305dac2af52f83681e9cb67280f 6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c git |
Not specified |
| CNA |
Linux |
Linux |
affected 3194c6870158e305dac2af52f83681e9cb67280f 686f942332b1667f13f3b8d6a2f50bcfbf42e277 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4.4 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 4.4 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.10.271 5.10.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.15.222 5.15.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.189 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.158 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.112 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.55 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.9 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/ed2e00bb22c73156bf8030b6204deabb25cf4eb5 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/f15ad9d6e9173a037587dded77c904fdae8df380 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/4d4601e182c8567329be7d919669ec4d847ddd93 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/e4b012240c8aaf57cec192234c24e0db5f531ffa |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/686f942332b1667f13f3b8d6a2f50bcfbf42e277 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/842c0603cfa49530ef081f181a2ddbba77a37231 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.