CVE-2026-98579 - Vulnerability Details

- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

nfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested
netlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc
ENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was
already queued.

Route them through a new free_list label, mirroring the SDRES path in
the same file which already does this. Harmless on the success path
too -- send_snl_sdreq() drains the list as it moves nodes, so it's
already empty by the time free_list runs.

Published: 2026-10-18

Score: 3.3 Low

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d9b8d8e19b073096d3609bbd60f82148d128b555`	affected	< 5b1eca82085134bd92cd3810b0ef003c91e3f668
`d9b8d8e19b073096d3609bbd60f82148d128b555`	affected	< d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02
`d9b8d8e19b073096d3609bbd60f82148d128b555`	affected	< 755bfc409748d8f3df64eb0eb26926270de3dd77
`d9b8d8e19b073096d3609bbd60f82148d128b555`	affected	< e43ec0191c1630f41e7043ac729ea6f1b8044a7f
`d9b8d8e19b073096d3609bbd60f82148d128b555`	affected	< 08d2c069239ab425fdd333784a6a3b3e034e4aa0
`d9b8d8e19b073096d3609bbd60f82148d128b555`	affected	< cbde7f5d326172d6dbb55cca0df42fa7e1ed8115
`d9b8d8e19b073096d3609bbd60f82148d128b555`	affected	< 0b01a946b0f234f5badd25968610b585a4895f08
`d9b8d8e19b073096d3609bbd60f82148d128b555`	affected	< 66f4300206b82b0b143ef0d9be90cd8d29f23a47

Linux

affected

Version	Status	Constraints
`3.10`	affected	—
`0`	unaffected	< 3.10
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d9b8d8e19b073096d3609bbd60f82148d128b555,5b1eca82085134bd92cd3810b0ef003c91e3f668)`	affected	code_commit	—
`[d9b8d8e19b073096d3609bbd60f82148d128b555,d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02)`	affected	code_commit	—
`[d9b8d8e19b073096d3609bbd60f82148d128b555,755bfc409748d8f3df64eb0eb26926270de3dd77)`	affected	code_commit	—
`[d9b8d8e19b073096d3609bbd60f82148d128b555,e43ec0191c1630f41e7043ac729ea6f1b8044a7f)`	affected	code_commit	—
`[d9b8d8e19b073096d3609bbd60f82148d128b555,08d2c069239ab425fdd333784a6a3b3e034e4aa0)`	affected	code_commit	—
`[d9b8d8e19b073096d3609bbd60f82148d128b555,cbde7f5d326172d6dbb55cca0df42fa7e1ed8115)`	affected	code_commit	—
`[d9b8d8e19b073096d3609bbd60f82148d128b555,0b01a946b0f234f5badd25968610b585a4895f08)`	affected	code_commit	—
`[d9b8d8e19b073096d3609bbd60f82148d128b555,66f4300206b82b0b143ef0d9be90cd8d29f23a47)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.10`	affected	generic	—
`[0,3.10)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98579.mbox
https://git.kernel.org/stable/c/08d2c069239ab425fdd333784a6a3b3e034e4aa0
https://git.kernel.org/stable/c/0b01a946b0f234f5badd25968610b585a4895f08
https://git.kernel.org/stable/c/5b1eca82085134bd92cd3810b0ef003c91e3f668
https://git.kernel.org/stable/c/66f4300206b82b0b143ef0d9be90cd8d29f23a47
https://git.kernel.org/stable/c/755bfc409748d8f3df64eb0eb26926270de3dd77
https://git.kernel.org/stable/c/cbde7f5d326172d6dbb55cca0df42fa7e1ed8115
https://git.kernel.org/stable/c/d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02
https://git.kernel.org/stable/c/e43ec0191c1630f41e7043ac729ea6f1b8044a7f
https://nvd.nist.gov/vuln/detail/CVE-2026-98579
https://www.cve.org/CVERecord?id=CVE-2026-98579

History

Tue, 20 Oct 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98579.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98579 https://www.cve.org/CVERecord?id=CVE-2026-98579
Metrics	threat_severity `None`	cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Low`

Sun, 18 Oct 2026 23:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc ENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was already queued. Route them through a new free_list label, mirroring the SDRES path in the same file which already does this. Harmless on the success path too -- send_snl_sdreq() drains the list as it moves nodes, so it's already empty by the time free_list runs.
Title		nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/08d2c069239ab425fdd333784a6a3b3e034e4aa0 https://git.kernel.org/stable/c/0b01a946b0f234f5badd25968610b585a4895f08 https://git.kernel.org/stable/c/5b1eca82085134bd92cd3810b0ef003c91e3f668 https://git.kernel.org/stable/c/66f4300206b82b0b143ef0d9be90cd8d29f23a47 https://git.kernel.org/stable/c/755bfc409748d8f3df64eb0eb26926270de3dd77 https://git.kernel.org/stable/c/cbde7f5d326172d6dbb55cca0df42fa7e1ed8115 https://git.kernel.org/stable/c/d3f60a7fc291d08cd9192a3b4cd5d3a223fa7d02 https://git.kernel.org/stable/c/e43ec0191c1630f41e7043ac729ea6f1b8044a7f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:52.611Z

Updated: 2026-10-19T09:22:04.617Z

Reserved: 2026-09-25T10:25:14.358Z

Link: CVE-2026-98579

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:10.363

Modified: 2026-10-19T10:19:18.453

Link: CVE-2026-98579

Redhat

Severity : Low

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98579 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T20:00:15Z

Weaknesses

CWE-772

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object