{"id":"CVE-2026-98583","title":"nfc: nfcmrvl: validate helper command length before pull","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nfcmrvl: validate helper command length before pull\n\nThe firmware download receive path removes the NCI data header and\nreads the helper command before validating …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < 842c0603cfa49530ef081f181a2ddbba77a37231","Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < e4b012240c8aaf57cec192234c24e0db5f531ffa","Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < f15ad9d6e9173a037587dded77c904fdae8df380","Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9","Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < 4d4601e182c8567329be7d919669ec4d847ddd93","Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < ed2e00bb22c73156bf8030b6204deabb25cf4eb5","Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < 6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c","Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < 686f942332b1667f13f3b8d6a2f50bcfbf42e277","Linux 4.4"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:18:56.360Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98583","references":[{"url":"https://git.kernel.org/stable/c/842c0603cfa49530ef081f181a2ddbba77a37231"},{"url":"https://git.kernel.org/stable/c/e4b012240c8aaf57cec192234c24e0db5f531ffa"},{"url":"https://git.kernel.org/stable/c/f15ad9d6e9173a037587dded77c904fdae8df380"},{"url":"https://git.kernel.org/stable/c/a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9"},{"url":"https://git.kernel.org/stable/c/4d4601e182c8567329be7d919669ec4d847ddd93"},{"url":"https://git.kernel.org/stable/c/ed2e00bb22c73156bf8030b6204deabb25cf4eb5"},{"url":"https://git.kernel.org/stable/c/6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c"},{"url":"https://git.kernel.org/stable/c/686f942332b1667f13f3b8d6a2f50bcfbf42e277"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.252Z","slug":"CVE-2026-98583","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nfcmrvl: validate helper command length before pull\n\nThe firmware download receive path removes the NCI data header and\nreads the helper command before validating the remaining packet length.\nA short frame can therefore reach the data access before the malformed\npacket is rejected.\n\nValidate the complete helper command length before stripping the NCI\ndata header.\n\n## Affected\n\n- `Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < 842c0603cfa49530ef081f181a2ddbba77a37231`\n- `Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < e4b012240c8aaf57cec192234c24e0db5f531ffa`\n- `Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < f15ad9d6e9173a037587dded77c904fdae8df380`\n- `Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < a4e56f57dd04d8f9bc6bc55f90f3d129da759ec9`\n- `Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < 4d4601e182c8567329be7d919669ec4d847ddd93`\n- `Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < ed2e00bb22c73156bf8030b6204deabb25cf4eb5`\n- `Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < 6a17a5806e9fcd99cf0dd30c3e6301f2aa1fac3c`\n- `Linux >= 3194c6870158e305dac2af52f83681e9cb67280f < 686f942332b1667f13f3b8d6a2f50bcfbf42e277`\n- `Linux 4.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}