Out-of-bounds read in Linux kernel - CVE-2026-98575
Published: October 22, 2026
Vulnerability identifier: #VU156878
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98575
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to system to trigger an out-of-bounds kernel memory read that may cause a denial of service.
The vulnerability exists due to an out-of-bounds read in pn533_acr122_is_rx_frame_valid() when validating USB response frames from an ACR122 device. An attacker with physical access to system can supply a crafted USB response through a malicious device with an unchecked frame->ccid.datalen value to read beyond the received buffer and potentially crash the kernel.
Affected software
Linux kernel
How to mitigate CVE-2026-98575
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/2450a388367231fb7dd798538f393af227c00c4d
- https://git.kernel.org/stable/c/72b8b2126e854d6756a1aa4bdc66d7457b832294
- https://git.kernel.org/stable/c/74b3fbc60907ee97e3af3249091f57351b53a6d6
- https://git.kernel.org/stable/c/8a0f1bb790d964893db7fc59febda9a534db07b3
- https://git.kernel.org/stable/c/8db3b1e012a8b25078dfa1efabe3d0cd2916dcba
- https://git.kernel.org/stable/c/b61732f47316d45f27706db7812950145d3327b5
- https://git.kernel.org/stable/c/e72cbedc4596e808d22dd2b9fff666ece76f8dd6
- https://git.kernel.org/stable/c/ea82b7576793219fa10a8b545f8338998b2a9ce2