CVE-2026-98579: Linux Kernel NFC LLCP Memory Leak Vulnerability

CVE-2026-98579 Overview

CVE-2026-98579 is a memory leak vulnerability in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) subsystem. The flaw resides in nfc_genl_llc_sdreq(), which builds a list of Type-Length-Value (TLV) nodes while iterating nested netlink attributes. Three error paths fail to free TLV nodes that were already queued, resulting in kernel memory being leaked on each failed Service Discovery Request (SDREQ) operation. The upstream fix routes the error paths through a new free_list label that mirrors the existing SDRES cleanup pattern in the same source file.

Critical Impact
Repeated triggering of the error paths can exhaust kernel memory, degrading system stability and enabling local denial-of-service conditions on affected hosts.

Affected Products

Linux kernel branches containing the vulnerable nfc_genl_llc_sdreq() implementation
Distributions shipping unpatched kernels with NFC LLCP support enabled
Systems exposing the NFC netlink interface to local users

Discovery Timeline

2026-10-18 - CVE-2026-98579 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98579

Vulnerability Analysis

The vulnerability resides in the NFC generic netlink handler nfc_genl_llc_sdreq() within the Linux kernel's NFC LLCP subsystem. The function walks nested netlink attributes to construct a linked list of TLV nodes representing Service Discovery Request entries. During normal processing, nodes are allocated, queued onto a local list, and then consumed by nfc_llcp_send_snl_sdreq() which drains the list as it transmits each entry.

Three failure paths break this contract. A nested attribute parse failure, a -ENOMEM return from the TLV allocator, and a failure inside nfc_llcp_send_snl_sdreq() all return without freeing nodes already placed on the queue. Each triggered error path leaks the kernel memory associated with those queued TLV nodes.

Root Cause

The root cause is missing cleanup in error paths, a classic resource management defect [CWE-401]. The function lacked a unified exit label that iterates the TLV list and releases each node before returning. The companion SDRES code path in the same file already implemented this pattern, making the omission inconsistent within the module.

Attack Vector

A local user with permission to issue NFC netlink commands can submit malformed SDREQ requests or trigger allocation failures under memory pressure. Each failed call leaks the queued TLV nodes. Repeating the operation steadily consumes non-swappable kernel memory. The vector requires local access to the NFC generic netlink family and does not provide code execution or privilege escalation on its own.

The fix adds a free_list label that both error paths and the success path traverse. On success the list is already empty because send_snl_sdreq() drained it, making the cleanup a no-op. On failure the label walks remaining nodes and frees them. See the upstream commits linked under References, including Kernel Commit 08d2c06 and Kernel Commit e43ec01.

Detection Methods for CVE-2026-98579

Indicators of Compromise

Sustained growth of kernel slab allocations tied to NFC LLCP objects without a corresponding workload increase
Repeated -ENOMEM or -EINVAL returns from the NFC generic netlink family on a single host
dmesg entries referencing LLCP service discovery failures accompanied by rising MemAvailable pressure

Detection Strategies

Monitor /proc/slabinfo for abnormal growth in kmalloc caches on systems that enable the CONFIG_NFC and LLCP options
Audit netlink traffic to the nfc generic family and correlate repeated SDREQ failures with the originating user and process
Enable kernel memory leak detection (kmemleak) in test environments to confirm the allocation site in nfc_genl_llc_sdreq()

Monitoring Recommendations

Track long-term kernel memory baselines on hosts with NFC hardware or NFC kernel modules loaded
Alert when the NFC module (nfc.ko) is loaded on servers that do not require NFC functionality
Review audit logs for processes invoking the NFC netlink family and flag unexpected callers

How to Mitigate CVE-2026-98579

Immediate Actions Required

Apply vendor kernel updates that include the upstream commits referenced in the NVD entry
Unload the nfc and nfc_llcp kernel modules on systems that do not use NFC
Restrict local user access on multi-tenant hosts until patched kernels are deployed

Patch Information

The fix is distributed across multiple stable kernel branches. Relevant commits include Kernel Commit 08d2c06, Kernel Commit 0b01a94, Kernel Commit 5b1eca8, Kernel Commit 66f4300, Kernel Commit 755bfc4, Kernel Commit cbde7f5, Kernel Commit d3f60a7, and Kernel Commit e43ec01. Consult your distribution's security tracker to map these to shipped package versions.

Workarounds

Blacklist the nfc module in /etc/modprobe.d/ on hosts without NFC requirements to prevent the vulnerable code path from loading
Use seccomp or namespace restrictions to block the AF_NETLINK family for untrusted workloads
Apply SELinux or AppArmor policies that deny access to the NFC generic netlink interface for non-privileged services

bash

# Configuration example
echo 'blacklist nfc' | sudo tee /etc/modprobe.d/disable-nfc.conf
echo 'blacklist nfc_llcp' | sudo tee -a /etc/modprobe.d/disable-nfc.conf
sudo rmmod nfc_llcp nfc 2>/dev/null || true
sudo update-initramfs -u