{"api_version":"1","generated_at":"2026-10-22T10:32:34+00:00","cve":"CVE-2026-98483","urls":{"html":"https://cve.report/CVE-2026-98483","api":"https://cve.report/api/cve/CVE-2026-98483.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98483","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98483"},"summary":{"title":"nfc: fix use-after-free in nfc_get_local_general_bytes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix use-after-free in nfc_get_local_general_bytes\n\nCommit 6709d4b7bc2e (\"net: nfc: Fix use-after-free caused by\nnfc_llcp_find_local\") attempted to fix a use-after-free (UAF) issue by\ninvoking nfc_llcp_local_put(local) after accessing local->gb. However,\nif the reference count drops to zero, local is freed immediately,\nleading to a use-after-free when callers access the returned pointer.\nAlternative approaches using dynamic allocation (e.g. kmemdup) introduced\nmemory leaks because callers consistently treat the returned pointer as\nborrowed memory.\n\nFix this properly by refactoring nfc_llcp_general_bytes() and\nnfc_get_local_general_bytes() to accept a caller-provided output buffer\n(out_gb) and its maximum length (gb_max_len). The general bytes are\nsafely copied into out_gb before calling nfc_llcp_local_put(local),\nensuring safe lifetime management without ownership transfer complications.\n\nUpdate all callers across drivers (microread, pn533, pn544, st21nfca,\ndigital_dep, and nci) to provide their own destination buffers and pass\nthem to nfc_get_local_general_bytes().","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:16:58","updated_at":"2026-10-19 10:18:59"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd","name":"https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0","name":"https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6","name":"https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d","name":"https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827","name":"https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf","name":"https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923","name":"https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1","name":"https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98483","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98483","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 96f2c6f272ec04083d828de46285a7d7b17d1aad 25bfa673adc70189c0bc872940421ae59f789cf6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc8429f8d86801f092fbfbd257c3af821ac0dcd3 2b31d0cc95856c856ada91f943fb14dfdf29a923 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 425d9d3a92df7d96b3cfb7ee5c240293a21cbde3 c40f61a6a413f3eaf028e5fe367fd9749e503ab0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6709d4b7bc2e079241fdef15d1160581c5261c10 19bcfc2a56d0b82919079b5424c5a9a0ac897dcf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6709d4b7bc2e079241fdef15d1160581c5261c10 d8c929e9afdbc33b1876ecb97a517e850449b5bd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6709d4b7bc2e079241fdef15d1160581c5261c10 841af260ff477f6191872bc3b2e15488615c1827 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6709d4b7bc2e079241fdef15d1160581c5261c10 9ede11e12f965ace97c4e0f606667f24fb41e7e1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6709d4b7bc2e079241fdef15d1160581c5261c10 dcab71a7011918f6fdba7adcec02d217dcb84b8d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b3ad46e155a6d91b36c6e892019a43e3ef3c696d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e5207c1d69b1a9707615ab6ff9376e59fc096815 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.188 5.10.271 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.121 5.15.222 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.39 6.1.189 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4.251 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.3.13 6.4 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.4.4 6.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.271 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.222 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.189 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.112 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.55 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nfc/microread/microread.c","drivers/nfc/pn533/pn533.c","drivers/nfc/pn533/pn533.h","drivers/nfc/pn544/pn544.c","drivers/nfc/st21nfca/core.c","include/net/nfc/hci.h","include/net/nfc/nfc.h","net/nfc/core.c","net/nfc/digital_dep.c","net/nfc/llcp_core.c","net/nfc/nci/core.c","net/nfc/nfc.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25bfa673adc70189c0bc872940421ae59f789cf6","status":"affected","version":"96f2c6f272ec04083d828de46285a7d7b17d1aad","versionType":"git"},{"lessThan":"2b31d0cc95856c856ada91f943fb14dfdf29a923","status":"affected","version":"fc8429f8d86801f092fbfbd257c3af821ac0dcd3","versionType":"git"},{"lessThan":"c40f61a6a413f3eaf028e5fe367fd9749e503ab0","status":"affected","version":"425d9d3a92df7d96b3cfb7ee5c240293a21cbde3","versionType":"git"},{"lessThan":"19bcfc2a56d0b82919079b5424c5a9a0ac897dcf","status":"affected","version":"6709d4b7bc2e079241fdef15d1160581c5261c10","versionType":"git"},{"lessThan":"d8c929e9afdbc33b1876ecb97a517e850449b5bd","status":"affected","version":"6709d4b7bc2e079241fdef15d1160581c5261c10","versionType":"git"},{"lessThan":"841af260ff477f6191872bc3b2e15488615c1827","status":"affected","version":"6709d4b7bc2e079241fdef15d1160581c5261c10","versionType":"git"},{"lessThan":"9ede11e12f965ace97c4e0f606667f24fb41e7e1","status":"affected","version":"6709d4b7bc2e079241fdef15d1160581c5261c10","versionType":"git"},{"lessThan":"dcab71a7011918f6fdba7adcec02d217dcb84b8d","status":"affected","version":"6709d4b7bc2e079241fdef15d1160581c5261c10","versionType":"git"},{"status":"affected","version":"dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548","versionType":"git"},{"status":"affected","version":"b3ad46e155a6d91b36c6e892019a43e3ef3c696d","versionType":"git"},{"status":"affected","version":"e5207c1d69b1a9707615ab6ff9376e59fc096815","versionType":"git"},{"lessThan":"5.10.271","status":"affected","version":"5.10.188","versionType":"semver"},{"lessThan":"5.15.222","status":"affected","version":"5.15.121","versionType":"semver"},{"lessThan":"6.1.189","status":"affected","version":"6.1.39","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.251","versionType":"semver"},{"lessThan":"6.4","status":"affected","version":"6.3.13","versionType":"semver"},{"lessThan":"6.5","status":"affected","version":"6.4.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nfc/microread/microread.c","drivers/nfc/pn533/pn533.c","drivers/nfc/pn533/pn533.h","drivers/nfc/pn544/pn544.c","drivers/nfc/st21nfca/core.c","include/net/nfc/hci.h","include/net/nfc/nfc.h","net/nfc/core.c","net/nfc/digital_dep.c","net/nfc/llcp_core.c","net/nfc/nci/core.c","net/nfc/nfc.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.5"},{"lessThan":"6.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.271","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.112","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.55","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.271","versionStartIncluding":"5.10.188","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.222","versionStartIncluding":"5.15.121","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.189","versionStartIncluding":"6.1.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.112","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.55","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.251","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix use-after-free in nfc_get_local_general_bytes\n\nCommit 6709d4b7bc2e (\"net: nfc: Fix use-after-free caused by\nnfc_llcp_find_local\") attempted to fix a use-after-free (UAF) issue by\ninvoking nfc_llcp_local_put(local) after accessing local->gb. However,\nif the reference count drops to zero, local is freed immediately,\nleading to a use-after-free when callers access the returned pointer.\nAlternative approaches using dynamic allocation (e.g. kmemdup) introduced\nmemory leaks because callers consistently treat the returned pointer as\nborrowed memory.\n\nFix this properly by refactoring nfc_llcp_general_bytes() and\nnfc_get_local_general_bytes() to accept a caller-provided output buffer\n(out_gb) and its maximum length (gb_max_len). The general bytes are\nsafely copied into out_gb before calling nfc_llcp_local_put(local),\nensuring safe lifetime management without ownership transfer complications.\n\nUpdate all callers across drivers (microread, pn533, pn544, st21nfca,\ndigital_dep, and nci) to provide their own destination buffers and pass\nthem to nfc_get_local_general_bytes()."}],"providerMetadata":{"dateUpdated":"2026-10-19T09:20:20.665Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/25bfa673adc70189c0bc872940421ae59f789cf6"},{"url":"https://git.kernel.org/stable/c/2b31d0cc95856c856ada91f943fb14dfdf29a923"},{"url":"https://git.kernel.org/stable/c/c40f61a6a413f3eaf028e5fe367fd9749e503ab0"},{"url":"https://git.kernel.org/stable/c/19bcfc2a56d0b82919079b5424c5a9a0ac897dcf"},{"url":"https://git.kernel.org/stable/c/d8c929e9afdbc33b1876ecb97a517e850449b5bd"},{"url":"https://git.kernel.org/stable/c/841af260ff477f6191872bc3b2e15488615c1827"},{"url":"https://git.kernel.org/stable/c/9ede11e12f965ace97c4e0f606667f24fb41e7e1"},{"url":"https://git.kernel.org/stable/c/dcab71a7011918f6fdba7adcec02d217dcb84b8d"}],"title":"nfc: fix use-after-free in nfc_get_local_general_bytes","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98483","datePublished":"2026-10-18T15:15:57.275Z","dateReserved":"2026-09-25T10:25:14.352Z","dateUpdated":"2026-10-19T09:20:20.665Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:16:58","lastModifiedDate":"2026-10-19 10:18:59","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98483","Ordinal":"1","Title":"nfc: fix use-after-free in nfc_get_local_general_bytes","CVE":"CVE-2026-98483","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98483","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix use-after-free in nfc_get_local_general_bytes\n\nCommit 6709d4b7bc2e (\"net: nfc: Fix use-after-free caused by\nnfc_llcp_find_local\") attempted to fix a use-after-free (UAF) issue by\ninvoking nfc_llcp_local_put(local) after accessing local->gb. However,\nif the reference count drops to zero, local is freed immediately,\nleading to a use-after-free when callers access the returned pointer.\nAlternative approaches using dynamic allocation (e.g. kmemdup) introduced\nmemory leaks because callers consistently treat the returned pointer as\nborrowed memory.\n\nFix this properly by refactoring nfc_llcp_general_bytes() and\nnfc_get_local_general_bytes() to accept a caller-provided output buffer\n(out_gb) and its maximum length (gb_max_len). The general bytes are\nsafely copied into out_gb before calling nfc_llcp_local_put(local),\nensuring safe lifetime management without ownership transfer complications.\n\nUpdate all callers across drivers (microread, pn533, pn544, st21nfca,\ndigital_dep, and nci) to provide their own destination buffers and pass\nthem to nfc_get_local_general_bytes().","Type":"Description","Title":"nfc: fix use-after-free in nfc_get_local_general_bytes"}]}}}