CVE-2026-98482

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

nfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via

nfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path

only guarantees the two-byte LLCP header -- __nfc_llcp_recv() checks it

with pskb_may_pull() and nfc_llcp_recv_agf() admits two-byte inner PDUs

-- so a two-byte I, RR or RNR PDU reads one byte of uninitialised skb

tailroom. The byte becomes N(R)/N(S); a peer can already set those with

a well-formed PDU, so this is acting on uninitialised memory, not new

peer control.

Guard the read with pskb_may_pull(), as commit 95674f506c63 ("nfc: llcp:

reject PDUs shorter than the LLCP header") did for the two-byte header,

so the sequence byte is present and linear before it is read. RR and RNR

PDUs are LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE bytes and an I PDU is

longer, so no valid frame is rejected; a truncated PDU is malformed, so

return without a DM reply.