CVE-2026-98583: Linux Kernel NFC Buffer Overflow Vulnerability

CVE-2026-98583 Overview

CVE-2026-98583 is a Linux kernel vulnerability in the nfcmrvl Near Field Communication (NFC) driver. The firmware download receive path strips the NFC Controller Interface (NCI) data header and reads the helper command before validating the remaining packet length. A short, malformed frame can reach the data access path before being rejected, resulting in an out-of-bounds read condition in kernel space.

The fix validates the complete helper command length before stripping the NCI data header. The flaw affects systems using Marvell NFC hardware with the nfcmrvl driver during firmware download operations.

Critical Impact
A malformed short frame delivered during NFC firmware download can trigger kernel memory access on undersized packets, potentially causing kernel panic or information disclosure.

Affected Products

Linux kernel nfc/nfcmrvl driver (firmware download path)
Multiple stable Linux kernel branches patched via eight upstream commits
Systems using Marvell NFC chipsets managed by the nfcmrvl driver

Discovery Timeline

2026-10-18 - CVE-2026-98583 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98583

Vulnerability Analysis

The vulnerability resides in the nfcmrvl NFC driver's firmware download receive handler. When processing incoming NCI packets, the code removes the NCI data header via a pull operation and reads helper command fields before checking that the packet is large enough to contain those fields. This ordering inversion allows a short frame to pass through the initial parsing step and reach a data access that assumes a minimum packet size.

An out-of-bounds read in kernel space can leak adjacent memory contents or trigger a kernel crash depending on allocation layout. The vulnerability is reachable through the NFC firmware download transport, so exploitation requires the ability to deliver crafted frames into the receive path.

Root Cause

The root cause is improper input validation ordering. The driver performs skb_pull() to strip the NCI data header and dereferences helper command fields before confirming that the socket buffer contains the expected number of bytes. The patch reorders the logic to validate the full helper command length first, rejecting malformed packets before any header strip or field access occurs.

Attack Vector

An attacker able to inject frames into the NFC firmware download channel — typically a local attacker with access to the NFC transport or a malicious peripheral — can send undersized NCI packets. The resulting access occurs in kernel context before the length check rejects the packet. See the upstream fix in Kernel Commit 4d4601e1 and backports 686f9423, 6a17a580, 842c0603, a4e56f57, e4b01224, ed2e00bb, and f15ad9d6.

No public proof-of-concept exploit is available. Refer to the kernel commits above for the precise code paths and remediation diff.

Detection Methods for CVE-2026-98583

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nfcmrvl or NCI processing functions
Kernel log entries showing malformed NFC frames during firmware download sequences
Repeated NFC subsystem resets or driver reload events on systems with Marvell NFC hardware

Detection Strategies

Monitor dmesg and /var/log/kern.log for crashes or warnings originating in the nfcmrvl module
Audit installed kernel versions against the fixed stable releases referenced in the upstream commits
Correlate NFC driver errors with system stability events across endpoint fleets

Monitoring Recommendations

Collect kernel ring buffer and crash telemetry centrally for correlation and retention
Alert on repeated driver-level faults in the NFC subsystem across similar hardware
Track kernel package versions and patch state across managed Linux endpoints

How to Mitigate CVE-2026-98583

Immediate Actions Required

Apply the latest stable Linux kernel update containing the nfcmrvl length-validation fix
Inventory systems with Marvell NFC hardware and prioritize patching those endpoints
Restrict physical and local access to systems exposing NFC firmware download paths

Patch Information

The fix validates the complete helper command length before stripping the NCI data header. Upstream patches are available across multiple stable branches via commits 4d4601e1, 686f9423, 6a17a580, 842c0603, a4e56f57, e4b01224, ed2e00bb, and f15ad9d6. Consume the fix through your distribution's kernel update channel.

Workarounds

Blacklist the nfcmrvl kernel module on systems that do not require Marvell NFC functionality
Disable NFC hardware in BIOS or firmware on endpoints where the feature is unused
Limit untrusted peripheral and local access to systems with active NFC stacks until patching is complete

bash

# Blacklist the nfcmrvl module until the kernel is patched
echo "blacklist nfcmrvl" | sudo tee /etc/modprobe.d/blacklist-nfcmrvl.conf
sudo modprobe -r nfcmrvl_usb nfcmrvl_uart nfcmrvl_i2c nfcmrvl_spi nfcmrvl 2>/dev/null
sudo update-initramfs -u