CVE-2026-98578: Linux Kernel NFC Buffer Overflow Vulnerability

CVE-2026-98578 is a buffer overflow flaw in the Linux kernel NFC st21nfca driver affecting ISO15693 inventory processing. This vulnerability allows potential memory corruption through improper length validation. This post explains its technical details, affected versions, impact, and mitigation steps.

CVE-2026-98578 Overview

CVE-2026-98578 affects the Linux kernel's nfc/st21nfca driver, specifically the ISO15693 inventory handling routine. The helper function strips a two-byte prefix from incoming NFC tag data without first verifying that the prefix is present. It then accepts a one-byte remainder and reads data[1] as the Data Storage Format Identifier (DSFID). This logic produces an out-of-bounds read when a malformed or truncated ISO15693 inventory response is processed. The upstream fix requires the prefix and at least two remaining bytes before copying the UID and reading the DSFID.

Critical Impact
A malicious or malformed ISO15693 NFC tag can trigger an out-of-bounds read in the kernel NFC subsystem, potentially leaking kernel memory or causing a denial of service.

Affected Products

Linux kernel builds that include the nfc/st21nfca driver
Systems using STMicroelectronics ST21NFCA NFC controllers with ISO15693 tag support
Stable kernel branches referenced by the backport commits listed in the kernel.org advisory

Discovery Timeline

2026-10-18 - CVE-2026-98578 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98578

Vulnerability Analysis

The vulnerability resides in the ISO15693 inventory helper within the st21nfca NFC driver. During tag discovery, the helper processes a response buffer that is expected to carry a two-byte protocol prefix followed by a DSFID byte and a Unique Identifier (UID). The function removes the prefix unconditionally and continues processing even when the remaining buffer is only one byte long. It then dereferences data[1] to extract the DSFID, reading beyond the valid buffer boundary.

An attacker able to deliver a crafted ISO15693 inventory response to a vulnerable host can trigger this out-of-bounds read. Because the parsing happens in kernel context, the consequences range from kernel memory disclosure to driver instability and system crashes. The fix enforces length validation before any prefix stripping or DSFID access.

Root Cause

The root cause is missing input validation [CWE-125] on attacker-controlled NFC frame data. The helper trusted that incoming buffers always contain the expected prefix plus payload, violating defensive parsing practices required for driver code that handles externally supplied data.

Attack Vector

Exploitation requires NFC proximity or control of the NFC tag presented to a vulnerable reader. An attacker crafts an ISO15693 inventory response that is shorter than the parser expects. When the kernel driver processes the response, the out-of-bounds read occurs. No authentication is required, but physical or near-physical access to the NFC interface is needed.

See the upstream fix in the Linux Kernel Commit 3af2ea4 for implementation details.

Detection Methods for CVE-2026-98578

Indicators of Compromise

Unexpected kernel oops or panic messages referencing st21nfca or nfc_hci call stacks
KASAN or UBSAN reports flagging out-of-bounds reads inside ISO15693 inventory handling
Repeated NFC driver resets or dmesg entries indicating malformed ISO15693 frames

Detection Strategies

Monitor kernel logs for crash signatures tied to the nfc/st21nfca driver and ISO15693 code paths
Correlate NFC subsystem errors with physical access events on devices that expose NFC readers
Deploy KASAN-instrumented kernels in test environments to surface the OOB read deterministically

Monitoring Recommendations

Forward dmesg, journald, and audit logs from NFC-enabled Linux endpoints to a central log store
Alert on repeated driver module reloads or NFC HCI protocol errors on production systems
Track kernel version inventory to confirm all hosts receive the stable backport fix

How to Mitigate CVE-2026-98578

Immediate Actions Required

Apply the Linux stable kernel update that includes the st21nfca ISO15693 length validation fix
Identify endpoints with ST21NFCA NFC hardware and prioritize patching based on exposure
Disable the st21nfca kernel module on systems that do not require NFC functionality

Patch Information

The fix is distributed across multiple stable branches. Reference commits include Linux Kernel Commit 3af2ea4, Linux Kernel Commit 57d1837, Linux Kernel Commit 6353dae, Linux Kernel Commit 7f2ea5e, Linux Kernel Commit 9fa21b0, Linux Kernel Commit a86987d, Linux Kernel Commit e47b2a3, and Linux Kernel Commit fdd95e8. Install the latest stable kernel release for your distribution to receive the backport.

Workarounds

Blacklist the st21nfca_hci and st21nfca_i2c modules on hosts that do not need NFC support
Restrict physical access to NFC readers on devices that cannot be patched immediately
Disable NFC hardware at the firmware or BIOS level where supported

bash

# Blacklist the vulnerable driver until a patched kernel is installed
echo 'blacklist st21nfca_hci' | sudo tee /etc/modprobe.d/blacklist-st21nfca.conf
echo 'blacklist st21nfca_i2c' | sudo tee -a /etc/modprobe.d/blacklist-st21nfca.conf
sudo update-initramfs -u
sudo reboot