Cloudanix VulnDB

CVE-2026-99100

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless driver in Linux could read memory it should not when given bad firmware, which might crash the system or leak information.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Out-of-bounds read in the p54 firmware parser caused by missing length validation on component ID, component version, and descriptor records, allowing the parser to access memory beyond allocated record boundaries.

Why it matters to the business

Linux systems using p54 wireless hardware may experience kernel crashes, memory corruption, or information disclosure when processing attacker-controlled or corrupted firmware images, increasing operational risk for affected wireless deployments.

How an attack unfolds

An attacker supplies a malformed p54 firmware image containing undersized records; when the driver parses the image it reads beyond record boundaries, potentially triggering a crash or leaking kernel memory contents.

How to fix it

Apply the upstream kernel patch that adds explicit length checks for component ID, component version, and descriptor records before any data access; rebuild and deploy the updated kernel on affected systems.

How to confirm the fix worked

Confirm the patched kernel source contains the length-validation checks for p54 firmware records; test by attempting to load a deliberately malformed firmware image and verifying the driver rejects it without out-of-bounds access.

Typical attack path

  1. Identify a target system using the p54 wireless driver
  2. Prepare a firmware image with deliberately truncated component ID, version, or descriptor records
  3. Cause the driver to load or re-parse the firmware (via device insertion, driver reload, or firmware update path)
  4. Trigger the length validation omission to perform out-of-bounds memory access

How to detect it

Review kernel logs for p54 firmware parsing warnings or oops messages immediately after firmware load attempts; inspect driver initialization traces for record-length-related failures.

What your security team should do

  • Prioritize kernel updates for any systems exposing p54 wireless hardware
  • Audit wireless driver firmware sources and restrict loading of untrusted firmware
  • Monitor vendor advisories for backported fixes in distribution kernels

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record. Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images. Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state.

Affected packages

Ecosystem Package Introduced Fixed