CVE-2026-98575 Overview
CVE-2026-98575 is an out-of-bounds read vulnerability in the Linux kernel's nfc/pn533 driver, specifically in the pn533_acr122_is_rx_frame_valid() function. The driver reads the frame->ccid.datalen field directly from an incoming USB response frame and uses it, unchecked, as an index into frame->data[]. A malicious or malfunctioning USB NFC device can set this field to an arbitrary value, causing the kernel driver to read far outside the received buffer.
Critical Impact
A crafted or faulty ACR122 USB NFC reader can trigger a kernel out-of-bounds read, potentially leading to information disclosure or kernel memory corruption from an attached peripheral.
Affected Products
- Linux kernel versions containing the nfc/pn533 driver with the ACR122 code path
- Systems using PN533-based USB NFC readers, including ACR122 devices
- Distributions that have not yet backported the referenced stable kernel commits
Discovery Timeline
- 2026-10-18 - CVE-2026-98575 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98575
Vulnerability Analysis
The pn533 driver supports ACR122 USB NFC readers using a CCID-style framing format. On each USB response, pn533_acr122_is_rx_frame_valid() inspects the frame header to confirm the payload is well-formed before further processing. The function previously only rejected frames where ccid.datalen equaled zero. Any other attacker-controlled value was accepted and used as an index into the fixed-size frame->data[] buffer.
Because datalen is a device-supplied field inside a USB response, a hostile or buggy device can set it to any 16-bit value. The driver then dereferences frame->data[datalen - 2], reading memory well beyond the received URB buffer. The patched version bounds datalen against the maximum possible ACR122 frame size and rejects values below 2, closing both the original zero-length case and a one-byte underflow of the datalen - 2 offset used later in the function.
Root Cause
The root cause is missing bounds validation on an untrusted length field received from a USB peripheral. The driver trusted frame->ccid.datalen without comparing it to the actual URB transfer length or the size of the frame->data[] array. This is a classic out-of-bounds read [CWE-125] stemming from improper input validation of hardware-supplied data.
Attack Vector
Exploitation requires an attacker-controlled USB device, either a malicious ACR122-compatible reader or a reprogrammed USB device that advertises matching VID/PID identifiers. When plugged into a vulnerable Linux host, the device sends a response frame with a manipulated ccid.datalen. The kernel driver then reads outside the response buffer, which can leak adjacent kernel memory contents, destabilize the driver, or produce kernel oops conditions depending on surrounding allocations.
See the upstream fix at Kernel Commit 74b3fbc and the backports referenced in the NVD entry for the exact code change.
Detection Methods for CVE-2026-98575
Indicators of Compromise
- Kernel log messages referencing pn533, pn533_acr122, or NFC USB driver faults around the time an unknown USB device was attached
- KASAN or slab-out-of-bounds reports pointing at pn533_acr122_is_rx_frame_valid in kernels built with memory sanitizers
- Unexpected USB device enumeration events for NFC-class readers on hosts that do not normally use NFC hardware
Detection Strategies
- Monitor dmesg and journal logs for pn533 driver warnings, oopses, or malformed-frame messages
- Audit USB device connect and disconnect events via udev, usbguard, or endpoint telemetry to flag unauthorized NFC readers
- Correlate kernel-mode crashes on endpoints with recent USB attach events to surface peripheral-triggered faults
Monitoring Recommendations
- Centralize kernel ring-buffer and auditd USB events into a SIEM or data lake for cross-host correlation
- Alert on new USB vendor and product IDs that match CCID or NFC classes on servers and workstations without a documented NFC use case
- Track kernel version inventory to confirm patch coverage across the fleet
How to Mitigate CVE-2026-98575
Immediate Actions Required
- Apply the latest stable Linux kernel update from your distribution that includes the referenced pn533 fix
- On hosts that do not need NFC functionality, blacklist the pn533 and pn533_usb kernel modules
- Restrict physical and administrative USB access on servers, kiosks, and shared workstations
Patch Information
The vulnerability is addressed by a series of stable kernel commits that bound ccid.datalen against the maximum ACR122 frame size before using it as an index. Relevant fixes include Kernel Commit 74b3fbc, Kernel Commit 2450a38, Kernel Commit 72b8b21, Kernel Commit 8a0f1bb, Kernel Commit 8db3b1e, Kernel Commit b61732f, Kernel Commit e72cbed, and Kernel Commit ea82b75. Rebuild or install the vendor-provided kernel package containing these backports and reboot.
Workarounds
- Unload and blacklist the pn533 and pn533_usb modules where NFC is not required
- Deploy USB device control policies, such as USBGuard rules, to allow only approved vendor and product IDs
- Enforce physical port restrictions on sensitive systems to prevent attachment of unknown USB peripherals
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
