CVE-2026-98578

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate ISO15693 inventory length

The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID.

Require the prefix and at least two remaining bytes before copying the UID data and reading the DSFID.