CVE-2026-98577

nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

nfc_llcp_wks_sap() compares only service_name_len bytes, so a short service_name like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length match before strncmp().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 0c83a8a45fed256ccc5fe7160b436b671fc79fb8Affected d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before aa555ed5ed0d15efbaf27e0e9f152a6df715278aAffected d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 32b5f0b338bf59391a1cff9a6190a72c4d2c1ba8Affected d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 6fad2c34d451d11a9f3f946cae1105fee91d96b8Affected d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before bf41af8f910cbb5d776a1dfa0671d31a7e262e28Affected d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before f234197f3bda3aea5d4b1e591d6bcb3660a8b3fcAffected d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 0a0412745c86acd089c6460da715ab966b1615e7Affected d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 408cff6bd60636df201274d320edfdfde9ed41dbAffected
LinuxLinux	3.3Affected before 3.3Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 0c83a8a45fed256ccc5fe7160b436b671fc79fb8Affected
d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before aa555ed5ed0d15efbaf27e0e9f152a6df715278aAffected
d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 32b5f0b338bf59391a1cff9a6190a72c4d2c1ba8Affected
d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 6fad2c34d451d11a9f3f946cae1105fee91d96b8Affected
d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before bf41af8f910cbb5d776a1dfa0671d31a7e262e28Affected
d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before f234197f3bda3aea5d4b1e591d6bcb3660a8b3fcAffected
d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 0a0412745c86acd089c6460da715ab966b1615e7Affected
d646960f7986fefb460a2b062d5ccc8ccfeacc3a to before 408cff6bd60636df201274d320edfdfde9ed41dbAffected

LinuxLinux

3.3Affected
before 3.3Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.