Live › vulnerability › CVE-2026-99100
Go to dashboardThe p54 Wi-Fi driver in the Linux kernel parses firmware component records without checking that their lengths cover the fields read, so a malformed firmware record can make the parser read past the record. The sources do not say what an attacker gets beyond that out-of-bounds read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 04:30 UTC. All times on this page are UTC.
Systems running a Linux kernel with the p54 Wi-Fi driver, typically machines with Prism54-based wireless adapters. Systems without p54 hardware or with the module not loaded are likely not exposed. The sources do not say how the firmware is supplied or whether a remote attacker can supply it.
No product ranges from the sources yet.
uname -r and whether the p54 driver is loaded with lsmod | grep p54p54usb.bin or p54pci.bin) under /lib/firmwareEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: validate firmware record lengths
The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record.
Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images.
Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state.
This page as .md · .json · in your agent: get_signal("CVE-2026-99100")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.