CVE-2026-98578

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate ISO15693 inventory length

The ISO15693 inventory helper removes a two-byte prefix without checking

that it exists, then accepts a one-byte remainder before reading data[1] as

the DSFID.

Require the prefix and at least two remaining bytes before copying the UID

data and reading the DSFID.