CVE-2026-99100
wifi: p54: validate firmware record lengths
What happened?
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: validate firmware record lengths
The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record.
Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images.
Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| LinuxLinux | affected: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 87a9aba92485889d510052e474999a6ec00b888c; affected: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < d5c28994b2c1440480fccd0b6c2ce72c23bb9fff; affected: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 9af312d3607c8f9b5166a19cbf40cee351cc3a1d; affected: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < dda5245afc3470d70406764e3d9f5508e534920a; affected: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7; affected: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < f641066b0ddcd1b0cf007c0d04f9c966f6e888ae; affected: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 8c4f962f368d5e17481f3c2c5a43028953e137a5; affected: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < db7b86bd97b380ece8fa39cfdd7502a9fd35e56f | See vendor advisory |
| LinuxLinux | affected: 2.6.24; unaffected: 0 to < 2.6.24; unaffected: 5.10.273 to ≤ 5.10.*; unaffected: 5.15.224 to ≤ 5.15.*; unaffected: 6.1.191 to ≤ 6.1.*; unaffected: 6.6.161 to ≤ 6.6.*; unaffected: 6.12.115 to ≤ 6.12.*; unaffected: 6.18.59 to ≤ 6.18.*; unaffected: 7.2.13 to ≤ 7.2.*; unaffected: 7.3 to ≤ * | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-99100
- https://git.kernel.org/stable/c/87a9aba92485889d510052e474999a6ec00b888c
- https://git.kernel.org/stable/c/d5c28994b2c1440480fccd0b6c2ce72c23bb9fff
- https://git.kernel.org/stable/c/9af312d3607c8f9b5166a19cbf40cee351cc3a1d
- https://git.kernel.org/stable/c/dda5245afc3470d70406764e3d9f5508e534920a
- https://git.kernel.org/stable/c/f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7
- https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae
- https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5
- https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f