PT-2026-34974 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-06 · CVE-2026-31622

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the NFC-A anti-collision cascade within the digital in recv sdd res() function. The process appends 3 or 4 bytes to target->nfcid1 during each round, but the number of rounds is controlled by the peer device via the cascade tag in the SDD RES and the cascade-incomplete bit in the SEL RES. Although ISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is sized for a maximum of 10 bytes (NFC NFCID1 MAXSIZE), the driver does not enforce this limit. A malicious peer can maintain the cascade to write past the heap-allocated nfc target.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2026-31622

ECHO-9BB8-094D-497D

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 77

• https://ubuntu.com/security/CVE-2026-31622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31622 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31622 · Vendor Advisory
• https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1 · Patch
• https://git.kernel.org/stable/c/46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31622 · Vendor Advisory
• https://git.kernel.org/stable/c/2819f34e08bdffb6f06a51c67948ec5737fb166a · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31622 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31622 · Vendor Advisory
• https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc · Patch
• https://git.kernel.org/stable/c/cc024a3de265ef6c58957f4990eccb9f806208cb · Patch
• https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba · Patch
• https://cve.org/CVERecord?id=CVE-2026-31622 · Security Note
• https://suse.com/security/cve/CVE-2026-31577 · Note