Cloudanix VulnDB

CVE-2026-98188

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless driver in the Linux kernel could read past the end of its data when given bad calibration information from certain old hardware, which might cause crashes or leaks.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in p54_convert_rev0() and p54_convert_rev1() when channel and points-per-channel counts from EEPROM calibration data exceed the actual entry length, bypassing length validation present in sibling converters.

Why it matters to the business

System instability, kernel panics, or limited information disclosure on devices using the p54 wireless driver, potentially disrupting wireless connectivity in legacy hardware deployments.

How an attack unfolds

An attacker with control over EEPROM contents or a malicious device presents crafted calibration curve data declaring excessive channel or point counts; the converters copy data using those counts without bounds checks, triggering the read past the buffer end.

How to fix it

Apply the upstream kernel patch that adds length validation in p54_convert_rev0() and p54_convert_rev1() before processing calibration data; rebuild and deploy the fixed kernel on affected systems.

How to confirm the fix worked

Confirm the presence of the validation check that rejects entries whose counts do not fit within the declared entry length; test with a KASAN-enabled kernel and a reproducer that supplies oversized counts.

Typical attack path

  1. Obtain or emulate a p54-compatible device with modifiable EEPROM calibration entry
  2. Craft an entry whose declared channel/point counts exceed actual data length
  3. Insert or attach the device so the driver loads the entry during initialization or calibration
  4. Trigger the conversion functions to perform the out-of-bounds read

How to detect it

Search kernel logs for oops or KASAN reports mentioning p54_convert_rev0 or p54_convert_rev1; inspect wireless initialization traces for EEPROM parsing failures after the patch date.

What your security team should do

  • Identify systems using the p54 driver and schedule kernel updates
  • Disable the p54 module if the hardware is not required
  • Monitor for kernel oops or KASAN reports referencing p54_convert functions

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54_convert_rev0() and p54_convert_rev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54_convert_output_limits() and p54_convert_db() already validate their counts against the entry length; this path was missed. Reject the entry when the counts do not fit in the entry data.

Affected packages

Ecosystem Package Introduced Fixed