CVE-2026-98576

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix slab-out-of-bounds reads when logging service names

nfc llcp wks sap() and nfc llcp build sdreq tlv() pass non-null- terminated strings to pr debug() using the %s format specifier. The buffers are allocated via kmemdup() or come from netlink attributes and are not guaranteed to be null-terminated, causing dynamic pr debug() to read beyond the allocated region:

KASAN: slab-out-of-bounds Read in dynamic pr debug

Fix both call sites by using %.*s with the explicit length to limit the output to the actual length of the string.