---
id: "CVE-2026-99100"
kind: "vulnerability"
aliases: ["CVE-2026-99100"]
title: "Linux kernel p54 Wi-Fi driver: firmware parser reads past record bounds"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "p54", "runtime", "wifi"]
not_affected_if: ["module-not-loaded", "no-p54-hardware"]
published_at: "2026-10-28T04:18:07+00:00"
first_seen_at: "2026-10-28T04:30:58+00:00"
updated_at: "2026-10-28T04:32:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99100", "first_seen_at": "2026-10-28T04:30:58+00:00"}]
---

# Linux kernel p54 Wi-Fi driver: firmware parser reads past record bounds

The p54 Wi-Fi driver in the Linux kernel parses firmware component records without checking that their lengths cover the fields read, so a malformed firmware record can make the parser read past the record. The sources do not say what an attacker gets beyond that out-of-bounds read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and whether the p54 driver is loaded with `lsmod | grep p54`
- Look for p54 firmware files (such as `p54usb.bin` or `p54pci.bin`) under `/lib/firmware`
- unknown for exact fixed kernel versions

## Fix

- Update the Linux kernel to a release that includes the upstream p54 firmware record length validation fix (exact version unknown)
- Blacklist the p54 module if Wi-Fi hardware using it is not needed (unknown from sources)

## Timeline

- 2026-10-28T04:30:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99100

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate firmware record lengths

The p54 firmware parser accesses component ID and component version
records without checking that their lengths cover the fields being read.
A malformed record can therefore make the parser read past the record.

Validate the component ID and component version record lengths before
accessing their data. The descriptor record is also checked against the
shortest descriptor length found in the supported firmware images.

Reject descriptor values that underflow the RX offset or produce an empty
RX range before updating the driver state.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_