Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-99100EUVD-2026-111586GHSA-M5MP-Q9HJ-5Q22

wifi: p54: validate firmware record lengths

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

The Linux kernel's wireless driver for Prism54 (p54) WiFi chipsets, which loads and parses firmware images, is affected. A malformed firmware file could cause the driver to read beyond the bounds of a firmware record, potentially leading to memory access errors or a crash.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record. Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images. Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. Record last updated

Affected versions

  • Linux Linux

    fixed in 5.10.273; fixed in 5.15.224; fixed in 6.1.191; fixed in 6.6.161; fixed in 6.12.115; fixed in 6.18.59; fixed in 7.2.13

  • Linux Linux

    Version range not reported

  • KernelLinux

    fixed in 6.18.59; From 6.19.0 · fixed in 7.2.13

References 8

git.kernel.org