CVE-2026-98577 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems and devices using NFC LLCP functionality should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams. They should verify patch application, review NFC LLCP implementation, and monitor for potential exploitation attempts.

Why it matters

CVE-2026-98577 is a vulnerability in the Linux kernel's NFC LLCP implementation that could allow WKS SAP hijacking. Defenders should prioritize patching and verifying NFC LLCP implementation.

• Verify and apply patches to prevent potential WKS SAP hijacking
• Review NFC LLCP implementation for exact length matching
• Monitor for exploitation attempts targeting NFC LLCP

Technical summary

The nfc_llcp_wks_sap() function in the Linux kernel's NFC LLCP implementation compares only the service_name_len bytes of the service name, allowing short service names to match longer WKS strings. This can be exploited to hijack WKS SAPs. The issue has been resolved by requiring an exact length match before performing the comparison. Defenders should prioritize verifying and applying the patch to the Linux kernel, particularly for systems and devices using NFC LLCP functionality, and review NFC LLCP implementation for exact length matching.

Defensive priority

Defenders should prioritize verifying and applying the patch to the Linux kernel, particularly for systems and devices using NFC LLCP functionality.

Recommended defensive actions

• Verify and apply the patch to the Linux kernel
• Review and update NFC LLCP implementation to ensure exact length matching
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions affected or fixed. The Linux kernel project has provided patches for the issue. Defenders should verify patch application and review NFC LLCP implementation for exact length matching. Evidence is limited, and further verification is required to ensure patch effectiveness.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.