{"id":"CVE-2026-99100","kind":"vulnerability","aliases":["CVE-2026-99100"],"related":[],"title":"Linux kernel p54 Wi-Fi driver: firmware parser reads past record bounds","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state.","summary":"The p54 Wi-Fi driver in the Linux kernel parses firmware component records without checking that their lengths cover the fields read, so a malformed firmware record can make the parser read past the record. The sources do not say what an attacker gets beyond that out-of-bounds read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","p54","runtime","wifi"],"not_affected_if":["module-not-loaded","no-p54-hardware"],"how_to_check":"- Check the running kernel version with `uname -r` and whether the p54 driver is loaded with `lsmod | grep p54`\n- Look for p54 firmware files (such as `p54usb.bin` or `p54pci.bin`) under `/lib/firmware`\n- unknown for exact fixed kernel versions","fix":"- Update the Linux kernel to a release that includes the upstream p54 firmware record length validation fix (exact version unknown)\n- Blacklist the p54 module if Wi-Fi hardware using it is not needed (unknown from sources)","status":"open","published_at":"2026-10-28T04:18:07+00:00","first_seen_at":"2026-10-28T04:30:58+00:00","triaged_at":"2026-10-28T04:32:07+00:00","updated_at":"2026-10-28T04:32:07+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-10-28T04:32:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream p54 firmware record length validation fix (exact version unknown)\n- Blacklist the p54 module if Wi-Fi hardware using it is not needed (unknown from sources)","reach":"unknown","title":"Linux kernel p54 Wi-Fi driver: firmware parser reads past record bounds","impact":"low","summary":"The p54 Wi-Fi driver in the Linux kernel parses firmware component records without checking that their lengths cover the fields read, so a malformed firmware record can make the parser read past the record. The sources do not say what an attacker gets beyond that out-of-bounds read.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","wifi","p54"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown; sources only describe an out-of-bounds read from malformed firmware","analyst_note":"Check the NVD entry and the upstream kernel commit for the fixed kernel versions and the attack vector.","how_to_check":"- Check the running kernel version with `uname -r` and whether the p54 driver is loaded with `lsmod | grep p54`\n- Look for p54 firmware files (such as `p54usb.bin` or `p54pci.bin`) under `/lib/firmware`\n- unknown for exact fixed kernel versions","needs_analyst":true,"not_affected_if":["no-p54-hardware","module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the p54 Wi-Fi driver, typically machines with Prism54-based wireless adapters. Systems without p54 hardware or with the module not loaded are likely not exposed. The sources do not say how the firmware is supplied or whether a remote attacker can supply it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":3397,"output_tokens":656,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99100':16A,19A 'access':98C,137C 'also':144C 'attack':69B 'beyond':71B 'bound':13A,76B 'check':41B,106C,145C 'compon':38B,99C,102C,129C,132C 'cover':45B,110C 'cve':14A,17A 'data':139C 'descriptor':141C,149C,158C 'driver':7A,31B,174C 'empti':168C 'fi':6A,30B 'field':47B,112C 'firmwar':8A,37B,52B,91C,96C,155C 'follow':83C 'found':151C 'get':70B 'id':100C,130C 'imag':156C 'kernel':2A,22B,35B,81C 'length':44B,93C,109C,135C,150C 'linux':1A,21B,34B,80C 'linux-kernel':20B 'make':55B,120C 'malform':51B,116C 'offset':164C 'out-of-bound':73B 'p54':3A,23B,27B,89C,95C 'pars':36B 'parser':9A,57B,97C,122C 'past':11A,59B,124C 'produc':166C 'rang':170C 'read':10A,48B,58B,77B,114C,123C 'record':12A,39B,53B,61B,92C,104C,117C,126C,134C,142C 'reject':157C 'resolv':87C 'runtim':24B 'rx':163C,169C 'say':66B 'shortest':148C 'sourc':63B 'state':175C 'support':154C 'therefor':119C 'underflow':161C 'updat':172C 'valid':90C,127C 'valu':159C 'version':103C,133C 'vulner':84C 'wi':5A,29B 'wi-fi':4A,28B 'wifi':25B,88C 'without':40B,105C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the p54 Wi-Fi driver, typically machines with Prism54-based wireless adapters. Systems without p54 hardware or with the module not loaded are likely not exposed. The sources do not say how the firmware is supplied or whether a remote attacker can supply it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T04:18:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99100","severity":null,"published_at":"2026-10-28T04:18:07+00:00","modified_at":"2026-10-28T04:18:07+00:00","first_seen_at":"2026-10-28T04:30:58+00:00","fetched_at":"2026-10-28T04:30:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}