CVE-2026-98187
Received Received - Intake

wifi: p54 full exp_if record required in PDR_INTERFACE_LIST

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST The PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if from it. A truncated trailing record makes the if_id/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak. Advance only while a full record still fits in the entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98187
EUVD
EUVD-2026-93115

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux eff1a59c48e3c6a006eb4fe5f2e405a996f2259d
Linux Linux eff1a59c48e3c6a006eb4fe5f2e405a996f2259d
Linux Linux eff1a59c48e3c6a006eb4fe5f2e405a996f2259d
Linux Linux eff1a59c48e3c6a006eb4fe5f2e405a996f2259d
Linux Linux eff1a59c48e3c6a006eb4fe5f2e405a996f2259d
Linux Linux eff1a59c48e3c6a006eb4fe5f2e405a996f2259d
Linux Linux eff1a59c48e3c6a006eb4fe5f2e405a996f2259d
Linux Linux eff1a59c48e3c6a006eb4fe5f2e405a996f2259d
Linux Linux 2.6.24

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the wifi p54 driver where the PDR_INTERFACE_LIST loop fails to validate that a record is complete before processing it. This can lead to reading beyond the intended memory boundary, causing data leaks or corruption.

Impact Analysis

An attacker could exploit this to read sensitive data from memory or cause system instability. Since the variant value affects the synth front-end selection, it may also lead to unauthorized wireless network access or misconfiguration.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-98187. Monitor vendor advisories for patches and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart