{"id":"AZL-108629","summary":"CVE-2026-98578 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate ISO15693 inventory length\n\nThe ISO15693 inventory helper removes a two-byte prefix without checking\nthat it exists, then accepts a one-byte remainder before reading data[1] as\nthe DSFID.\n\nRequire the prefix and at least two remaining bytes before copying the UID\ndata and reading the DSFID.","modified":"2026-10-19T14:16:31.327472506Z","published":"2026-10-18T16:17:10Z","upstream":["CVE-2026-98578"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98578"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108629.json"}}],"schema_version":"1.9.0"}