All vulnerabilities
CVE-2026-99100

Linux: wifi: p54: validate firmware record lengths

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in8c4f962f368d5e17481f3c2c5a43028953e137a5Also 6.18.59, 7.2.13CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate firmware record lengths

The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record.

Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images.

Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state.

Text from CVE List

Affected versions 8

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f641066b0ddcd1b0cf007c0d04f9c966f6e888aeCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8c4f962f368d5e17481f3c2c5a43028953e137a5CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before db7b86bd97b380ece8fa39cfdd7502a9fd35e56fCVE List
  • Linuxaffected: all versions before 6.18.59CVE List
  • Linuxaffected: all versions before 7.2.13CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3