SB20261022156 - Memory leak in Linux kernel nfc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022156

SB20261022156 - Memory leak in Linux kernel nfc

Published: October 22, 2026

Security Bulletin ID SB20261022156
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Memory leak (CVE-ID: CVE-2026-98579)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to leak kernel memory, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to missing deallocation of queued TLV nodes in the Linux kernel NFC LLCP function nfc_genl_llc_sdreq() when nested netlink attribute parsing, TLV allocation, or service discovery request transmission fails. A local user can repeatedly submit requests that trigger these error paths after TLV nodes have been queued to leak kernel memory and potentially exhaust available memory.


Remediation

Install update from vendor's website.

References