CVE-2026-99100
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record. Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images. Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-28 04:18:07.417000
Last modified
2026-10-30 13:21:45.053000
View original CVE JSON
{
"id": "CVE-2026-99100",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-28T04:18:07.417",
"lastModified": "2026-10-30T13:21:45.053",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/wireless/intersil/p54/fwio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "87a9aba92485889d510052e474999a6ec00b888c",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "d5c28994b2c1440480fccd0b6c2ce72c23bb9fff",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "9af312d3607c8f9b5166a19cbf40cee351cc3a1d",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "dda5245afc3470d70406764e3d9f5508e534920a",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "f641066b0ddcd1b0cf007c0d04f9c966f6e888ae",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "8c4f962f368d5e17481f3c2c5a43028953e137a5",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "db7b86bd97b380ece8fa39cfdd7502a9fd35e56f",
"versionType": "git",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.10.273",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.15.224",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.1.191",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.6.161",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.12.115",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.18.59",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "7.2.13",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/wireless/intersil/p54/fwio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.161",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.115",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.59",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.13",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/87a9aba92485889d510052e474999a6ec00b888c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9af312d3607c8f9b5166a19cbf40cee351cc3a1d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d5c28994b2c1440480fccd0b6c2ce72c23bb9fff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dda5245afc3470d70406764e3d9f5508e534920a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}