{"id":"CVE-2026-98480","title":"nfc: trf7970a: power down on startup RX gain failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: trf7970a: power down on startup RX gain failure\n\ntrf7970a_startup() powers up the device before applying the optional RX\ngain reduction. If the register read or wr…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5d69351820eab6be1d298af21aedd18be5e5a11a < cc444e4ad43461374dd128573eccb8979d2adb4c","Linux >= 5d69351820eab6be1d298af21aedd18be5e5a11a < 6ef70d790425e76b42c69e416ee78c62bdc37d00","Linux >= 5d69351820eab6be1d298af21aedd18be5e5a11a < d2acbde7e67df44efa8f0963462d1192e7694ffc","Linux 6.17"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:15:54.528Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98480","references":[{"url":"https://git.kernel.org/stable/c/cc444e4ad43461374dd128573eccb8979d2adb4c"},{"url":"https://git.kernel.org/stable/c/6ef70d790425e76b42c69e416ee78c62bdc37d00"},{"url":"https://git.kernel.org/stable/c/d2acbde7e67df44efa8f0963462d1192e7694ffc"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.297Z","slug":"CVE-2026-98480","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfc: trf7970a: power down on startup RX gain failure\n\ntrf7970a_startup() powers up the device before applying the optional RX\ngain reduction. If the register read or write fails, it returns without\nundoing that power-up. Probe's unwind only drops the separate regulator\nreferences acquired by probe, leaving the additional VIN enable from\nstartup unbalanced. The system resume caller also has no power-down on\nthis error.\n\nCall trf7970a_power_down() before returning the RX gain error to deassert\nthe enable GPIOs, release the startup VIN reference and restore the\npowered-off state. Runtime PM has not been enabled yet, so the full\nshutdown helper is not appropriate here. Preserve the original SPI error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.\n\n## Affected\n\n- `Linux >= 5d69351820eab6be1d298af21aedd18be5e5a11a < cc444e4ad43461374dd128573eccb8979d2adb4c`\n- `Linux >= 5d69351820eab6be1d298af21aedd18be5e5a11a < 6ef70d790425e76b42c69e416ee78c62bdc37d00`\n- `Linux >= 5d69351820eab6be1d298af21aedd18be5e5a11a < d2acbde7e67df44efa8f0963462d1192e7694ffc`\n- `Linux 6.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}