CVE-2026-98483

In the Linux kernel, the following vulnerability has been resolved:

nfc: fix use-after-free in nfc get local general bytes

Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc llcp find local") attempted to fix a use-after-free (UAF) issue by invoking nfc llcp local put(local) after accessing local->gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory.

Fix this properly by refactoring nfc llcp general bytes() and nfc get local general bytes() to accept a caller-provided output buffer (out gb) and its maximum length (gb max len). The general bytes are safely copied into out gb before calling nfc llcp local put(local), ensuring safe lifetime management without ownership transfer complications.

Update all callers across drivers (microread, pn533, pn544, st21nfca, digital dep, and nci) to provide their own destination buffers and pass them to nfc get local general bytes().