Memory leak in Linux kernel - CVE-2026-98579
Published: October 22, 2026
Vulnerability identifier: #VU156882
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98579
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to leak kernel memory, potentially causing a denial of service through memory exhaustion.
The vulnerability exists due to missing deallocation of queued TLV nodes in the Linux kernel NFC LLCP function nfc_genl_llc_sdreq() when nested netlink attribute parsing, TLV allocation, or service discovery request transmission fails. A local user can repeatedly submit requests that trigger these error paths after TLV nodes have been queued to leak kernel memory and potentially exhaust available memory.
Affected software
Linux kernel
How to mitigate CVE-2026-98579
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/08d2c069239ab425fdd333784a6a3b3e034e4aa0
- https://git.kernel.org/stable/c/0b01a946b0f234f5badd25968610b585a4895f08
- https://git.kernel.org/stable/c/5b1eca82085134bd92cd3810b0ef003c91e3f668
- https://git.kernel.org/stable/c/66f4300206b82b0b143ef0d9be90cd8d29f23a47
- https://git.kernel.org/stable/c/755bfc409748d8f3df64eb0eb26926270de3dd77
- https://git.kernel.org/stable/c/cbde7f5d326172d6dbb55cca0df42fa7e1ed8115
- https://git.kernel.org/stable/c/d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02
- https://git.kernel.org/stable/c/e43ec0191c1630f41e7043ac729ea6f1b8044a7f