Partial String Comparison in Linux kernel - CVE-2026-98577
Published: October 22, 2026
Vulnerability identifier: #VU156880
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98577
CWE-ID: CWE-187
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to hijack well-known service access points in the Linux kernel NFC subsystem.
The vulnerability exists due to a partial string comparison in nfc_llcp_wks_sap() when resolving NFC logical link control service names. A local user can supply a short service name such as "u" that matches the prefix of "urn:nfc:sn:snep" to obtain the service access point associated with the longer well-known service name.
Affected software
Linux kernel
How to mitigate CVE-2026-98577
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0a0412745c86acd089c6460da715ab966b1615e7
- https://git.kernel.org/stable/c/0c83a8a45fed256ccc5fe7160b436b671fc79fb8
- https://git.kernel.org/stable/c/32b5f0b338bf59391a1cff9a6190a72c4d2c1ba8
- https://git.kernel.org/stable/c/408cff6bd60636df201274d320edfdfde9ed41db
- https://git.kernel.org/stable/c/6fad2c34d451d11a9f3f946cae1105fee91d96b8
- https://git.kernel.org/stable/c/aa555ed5ed0d15efbaf27e0e9f152a6df715278a
- https://git.kernel.org/stable/c/bf41af8f910cbb5d776a1dfa0671d31a7e262e28
- https://git.kernel.org/stable/c/f234197f3bda3aea5d4b1e591d6bcb3660a8b3fc