CVE-2026-98483: Linux Kernel NFC Use-After-Free Vulnerability

CVE-2026-98483 Overview

CVE-2026-98483 is a use-after-free vulnerability in the Linux kernel's Near Field Communication (NFC) subsystem. The flaw resides in nfc_get_local_general_bytes() within the Logical Link Control Protocol (LLCP) code path. A prior fix (commit 6709d4b7bc2e) introduced the regression by calling nfc_llcp_local_put(local) after accessing local->gb. When the reference count drops to zero, local is freed immediately, leaving callers dereferencing a stale pointer to the returned general bytes buffer.

Critical Impact
Local attackers interacting with NFC drivers can trigger memory corruption in kernel space, potentially leading to kernel crashes or elevation of privilege on affected Linux systems.

Affected Products

Linux kernel versions containing commit 6709d4b7bc2e prior to the fix
NFC-enabled builds using drivers microread, pn533, pn544, st21nfca, digital_dep, and nci
Stable kernel branches referenced in the backport commits listed under External References

Discovery Timeline

2026-10-18 - CVE-2026-98483 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98483

Vulnerability Analysis

The Linux NFC LLCP subsystem exposes general bytes used during peer-to-peer link setup. The function nfc_get_local_general_bytes() returned a pointer into the local structure's gb field. The earlier remediation added nfc_llcp_local_put(local) to balance reference counts after reading local->gb.

If the put call drops the refcount to zero, the allocator frees local immediately. Callers then operate on the returned pointer, which now references freed memory. This produces a classic use-after-free [CWE-416] in kernel memory.

An earlier alternative using kmemdup() to allocate a duplicate buffer introduced memory leaks because callers treated the returned pointer as borrowed memory and never freed it. The accepted fix refactors nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer (out_gb) and a maximum length (gb_max_len). The general bytes are copied into the caller's buffer before nfc_llcp_local_put(local) runs.

Root Cause

The root cause is improper object lifetime management. Returning a borrowed pointer into a reference-counted structure, then releasing the final reference before the caller consumes the data, violates ownership semantics in the NFC LLCP API.

Attack Vector

Exploitation requires local interaction with NFC subsystem interfaces through driver ioctls or Netlink sockets backed by microread, pn533, pn544, st21nfca, digital_dep, or nci. Triggering the race around reference-count teardown allows a local attacker to free local while the general bytes pointer is still in use, enabling kernel memory corruption. No verified public exploit is available at this time.

Detection Methods for CVE-2026-98483

Indicators of Compromise

Kernel oops or panic logs referencing nfc_get_local_general_bytes, nfc_llcp_general_bytes, or nfc_llcp_local_put in the stack trace
KASAN reports flagging use-after-free in the NFC LLCP code path
Unexpected reloads of NFC driver modules (pn533, pn544, st21nfca, nci, microread) following crashes

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test builds to surface use-after-free conditions during NFC exercises
Audit kernel version strings on fleet systems against the stable commit hashes listed in the kernel.org references
Monitor dmesg and journalctl -k for repeated faults originating in net/nfc/llcp_commands.c or related modules

Monitoring Recommendations

Collect kernel crash dumps centrally and alert on signatures containing NFC LLCP symbols
Track module load events for NFC drivers on endpoints that do not require NFC functionality
Correlate device uptime drops with kernel ring buffer errors on NFC-enabled hardware

How to Mitigate CVE-2026-98483

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 19bcfc2, 25bfa67, 2b31d0c, 841af26, 9ede11e, c40f61a, d8c929e, and dcab71a
Rebuild and deploy kernels from distribution vendors as updated packages ship for affected stable branches
Where NFC is not required, blacklist NFC driver modules until patched kernels are in place

Patch Information

The fix refactors nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer and length. All callers in microread, pn533, pn544, st21nfca, digital_dep, and nci were updated to supply their own destination buffers. See the Kernel Git Commit 19bcfc2 and the Kernel Git Commit dcab71a for the authoritative source changes.

Workarounds

Unload and blacklist NFC kernel modules on systems that do not require NFC: add entries for nfc, nci, pn533, pn544, st21nfca, and microread to /etc/modprobe.d/
Restrict physical and local user access to systems with NFC hardware until patches are deployed
Disable NFC hardware in BIOS or firmware where supported on endpoints that do not need the capability

bash

# Blacklist NFC modules to prevent loading on unpatched kernels
cat <<'EOF' | sudo tee /etc/modprobe.d/disable-nfc.conf
blacklist nfc
blacklist nci
blacklist pn533
blacklist pn544
blacklist st21nfca
blacklist microread
EOF

sudo depmod -a
sudo update-initramfs -u