CVE-2026-64571
Received Received - Intake

Buffer Overflow in Linux Kernel p54 WiFi Driver

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54_rx_eeprom_readback() p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()") closed the destination overflow by copying a fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len), but the source side is still unbounded: nothing verifies the frame is long enough to supply that many bytes. A malicious USB device can send a short frame whose advertised len matches priv->eeprom_slice_size while the payload is truncated. The equality check passes and memcpy() reads past the end of the skb, leaking adjacent heap: BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) Read of size 1016 at addr ffff88800f077114 by task swapper/0/0 Call Trace: <IRQ> ... __asan_memcpy (mm/kasan/shadow.c:105) p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005) ... </IRQ> The buggy address belongs to the object at ffff88800f0770c0 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 84 bytes inside of allocated 704-byte region [ffff88800f0770c0, ffff88800f077380) Check that the slice fits in the skb before copying.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64571
EUVD
EUVD-2026-53265

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel p54 *
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow issue in the Linux kernel's p54 WiFi driver. The function p54_rx_eeprom_readback() copies data from a USB device's frame without verifying the frame's actual length. A malicious USB device can send a short frame with a misleading length, causing the kernel to read beyond the allocated memory and leak adjacent heap data.

Detection Guidance

This vulnerability involves a buffer overflow in the Linux kernel's p54 wireless driver due to improper validation of RX frame length. Detection requires checking for kernel logs indicating slab-out-of-bounds errors in p54_rx or related functions. Monitor dmesg for KASAN reports or unusual heap corruption messages.

Impact Analysis

This vulnerability could allow an attacker with physical access to a system to potentially execute arbitrary code or cause a denial of service by exploiting the heap memory corruption. It may lead to system crashes or unauthorized data access if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level memory corruption issue in the Linux kernel's wifi driver. It could potentially lead to unauthorized data access if exploited, which might indirectly impact compliance if sensitive data is exposed.

Mitigation Strategies

Apply the kernel patch that validates RX frame length in p54_rx_eeprom_readback(). Update to a patched kernel version. If immediate patching is not possible, disable the p54 wireless driver module (p54usb) to prevent exploitation via malicious USB devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart