CVE-2026-98481: Linux Kernel NFC Port100 Buffer Overflow

CVE-2026-98481 Overview

CVE-2026-98481 is an out-of-bounds read vulnerability in the Linux kernel's Near Field Communication (NFC) port100 USB driver. The flaw resides in port100_recv_response(), which forwards the USB Request Block (URB) transfer buffer to port100_rx_frame_is_valid() without validating that the device-supplied datalen field matches the actual bytes received. A malicious or malfunctioning USB NFC device can advertise a datalen larger than the real frame, causing port100_data_checksum() to read memory beyond the transfer buffer. The upstream fix rejects any response whose declared frame size exceeds urb->actual_length before checksum validation.

Critical Impact
An attacker with physical access to a USB port can supply a crafted NFC response that triggers a kernel out-of-bounds read, potentially leaking adjacent kernel memory or causing a denial of service.

Affected Products

Linux kernel (upstream drivers/nfc/port100.c)
Linux stable branches referenced by the published fix commits
Distributions shipping the port100 NFC driver on affected kernels

Discovery Timeline

Reported by 0sec (https://0sec.ai) using automated source analysis
2026-10-18 - CVE-2026-98481 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98481

Vulnerability Analysis

The port100 driver supports Sony NFC USB readers in the Linux kernel. When the host receives a USB response, port100_recv_response() hands the transfer buffer to port100_rx_frame_is_valid(). That validator computes a checksum over le16_to_cpu(frame->datalen) bytes starting at frame->data.

The datalen field is a 16-bit little-endian value populated by the attached device. The driver never cross-checks datalen against urb->actual_length, which represents the actual number of bytes delivered by the USB stack. A device advertising a datalen larger than the transferred frame causes port100_data_checksum() to iterate past the end of the URB buffer, producing an out-of-bounds read of kernel heap memory.

The consequences include kernel memory disclosure, driver-level denial of service, and potential downstream corruption depending on allocator layout. The issue was identified through automated source analysis and compile-tested by the submitter.

Root Cause

The root cause is missing input validation on untrusted USB device data. The driver trusts a length value supplied by the peripheral without bounding it against the receive buffer size. This matches the pattern of out-of-bounds read vulnerabilities arising from unchecked length fields in protocol parsers.

Attack Vector

Exploitation requires an attacker-controlled or malicious USB NFC device enumerating as a port100-compatible reader. When the kernel issues a request, the device returns a response header where datalen exceeds urb->actual_length. The driver proceeds to checksum beyond the buffer, reading adjacent memory. No authentication is required beyond the ability to attach USB hardware.

No verified public exploit code is available. The upstream commits referenced in the advisory describe the one-line validation that resolves the issue.

Detection Methods for CVE-2026-98481

Indicators of Compromise

Kernel log entries referencing port100 frame validation failures or unexpected URB lengths
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads inside port100_data_checksum() or port100_rx_frame_is_valid()
Unexpected USB device enumerations advertising Sony NFC vendor/product identifiers on systems that do not use NFC readers

Detection Strategies

Audit running kernel versions against the fixed stable branches referenced in the upstream commits
Enable KASAN in test environments to surface out-of-bounds reads from the port100 driver during fuzzing
Monitor dmesg and journald for nfc subsystem errors following USB device attachments

Monitoring Recommendations

Track USB device connect/disconnect events via udev and forward to centralized logging
Alert on NFC driver load events (modprobe port100) on endpoints that have no business running NFC
Correlate physical-access events with USB enumeration logs to identify suspicious device plug-ins

How to Mitigate CVE-2026-98481

Immediate Actions Required

Apply the Linux stable kernel updates containing the referenced fix commits (035056e, 092c6a6, 0d48299, 144ad47, 14b1467, 9e8df08, db66a30, e4da145)
Rebuild and reboot affected systems after installing patched kernel packages from your distribution
Inventory endpoints that load the port100 module and prioritize patching for systems with physical USB exposure

Patch Information

The fix adds a bounds check in port100_recv_response() that rejects any response whose declared frame size does not fit the received urb->actual_length before passing the buffer to the checksum validator. Patch commits are published in the Linux stable tree: 035056e, 092c6a6, 0d48299, 144ad47, 14b1467, 9e8df08, db66a30, and e4da145.

Workarounds

Blacklist the port100 kernel module on systems that do not require NFC USB reader support
Enforce USB device allowlisting using USBGuard or equivalent to prevent unknown NFC devices from binding
Disable unused USB ports via firmware policy on high-value or kiosk-mode endpoints

bash

# Blacklist the port100 driver on systems that do not use NFC readers
echo 'blacklist port100' | sudo tee /etc/modprobe.d/blacklist-port100.conf
sudo rmmod port100 2>/dev/null
sudo update-initramfs -u