Is there a patch available for CVE-2026-98582?

Yes, a patch is available for CVE-2026-98582. Update the affected software to the latest version immediately.

Linux CVE-2026-98582

EUVD-2026-103627

2026-10-18 Linux

GHSA-g367-xhx5-qhm5

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate received frame size

st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it unconditionally reads the byte after an escape marker.

A malformed frame can place EOF immediately after the start marker or can end its data portion with an escape marker. The former leaves too few bytes for check_crc(), while the latter makes the unstuffing loop read past the current skb length.

Require the minimum framing bytes both before and after unstuffing. Use separate input and output cursors while removing byte stuffing, and reject an escape marker without its encoded byte. This keeps malformed frames within the received frame boundary before CRC processing.

Affected VersionsENISA

Linux patch: 5.10.271

Linux patch: 0

Linux patch: 7.3-rc5

Linux 3.16

Linux patch: 6.6.158

Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <91be5161f37b0a2795ad6806d69be5fa74522e5c

Linux patch: 5.15.222

Linux patch: 6.1.189

Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <d0596ee6c4b928a5c288790522a7495ee867da72

Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <a653c01ce447f10c36b901646888c0330363af4f

Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <57919d0662d8856211b794140172e51ca389f23d

Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <8934d2889ae16a7c77520e002398d0689c1ecea5

Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <7b996cc06dda54c02a5aa607bda01109f0ac51e6

Linux patch: 6.12.112

Linux patch: 7.2.9

Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <d4008c3499dba7829bfe002edd99a8bff8ae3a7c

Linux 3096e25a3e40b73afd59e46f3bf8d84f919992a1 <f526c218a149a30f110ce434ff17e033042404b8

Linux patch: 6.18.55

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 18, 2026 - 16:02 EUVD

CVE Published

Oct 18, 2026 - 15:18 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.