Cloudanix VulnDB

CVE-2026-98187

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how certain older wireless adapters read their configuration data could let an attacker see pieces of the computer's internal memory or cause the radio to behave incorrectly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read when parsing a truncated PDR_INTERFACE_LIST record in the p54 driver allows kernel heap memory beyond the EEPROM buffer to be read into if_id/variant fields, with the variant also controlling synth front-end selection.

Why it matters to the business

Potential exposure of kernel memory contents on systems using the p54 wireless driver, which could aid further attacks or cause incorrect hardware initialization; low exploitability reduces immediate risk but still requires timely patching on affected Linux kernels.

How an attack unfolds

An attacker supplies a crafted or truncated EEPROM/PDR data set containing an incomplete exp_if record; when the p54 driver loads and iterates PDR_INTERFACE_LIST it performs an unchecked full-struct read that crosses the buffer boundary into the heap, disclosing memory and influencing radio configuration.

How to fix it

Apply the upstream kernel patch that advances the loop only while a complete exp_if record fits inside the entry; rebuild and deploy the fixed kernel on all systems using the p54 driver.

How to confirm the fix worked

Confirm the presence of the bounds-check patch in the p54 source (advance only on full-record fit), run KASAN-enabled reproducer tests, and verify that truncated records no longer produce out-of-bounds accesses.

Typical attack path

  1. Obtain or craft a malicious EEPROM image with a truncated trailing PDR record
  2. Cause the target system to load the p54 driver with the supplied EEPROM data
  3. Trigger the PDR_INTERFACE_LIST parsing loop to perform the out-of-bounds struct read
  4. Observe leaked kernel memory or altered synth front-end behavior

How to detect it

Monitor kernel logs for KASAN reports referencing p54 and PDR_INTERFACE_LIST; inspect driver initialization paths that parse EEPROM data for unexpected memory accesses or variant values outside documented ranges.

What your security team should do

  • Identify all Linux systems that load the p54 module and schedule kernel updates
  • Prioritize patching within normal change windows given the stable low EPSS and absence from KEV
  • Add kernel memory-safety testing (KASAN) to the wireless driver validation pipeline

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST The PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if from it. A truncated trailing record makes the if_id/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak. Advance only while a full record still fits in the entry.

Affected packages

Ecosystem Package Introduced Fixed