{"id":"AZL-109082","summary":"CVE-2026-98482 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()\n\nnfc_llcp_recv_hdlc() reads the sequence byte skb-\u003edata[2], via\nnfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path\nonly guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it\nwith pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs\n-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb\ntailroom. The byte becomes N(R)/N(S); a peer can already set those with\na well-formed PDU, so this is acting on uninitialised memory, not new\npeer control.\n\nGuard the read with pskb_may_pull(), as commit 95674f506c63 (\"nfc: llcp:\nreject PDUs shorter than the LLCP header\") did for the two-byte header,\nso the sequence byte is present and linear before it is read. RR and RNR\nPDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is\nlonger, so no valid frame is rejected; a truncated PDU is malformed, so\nreturn without a DM reply.","modified":"2026-10-19T14:16:31.531761588Z","published":"2026-10-18T16:16:58Z","upstream":["CVE-2026-98482"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98482"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109082.json"}}],"schema_version":"1.9.0"}