CVE-2026-99100

{"id": "CVE-2026-99100", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "87a9aba92485889d510052e474999a6ec00b888c", "versionType": "git"}, {"status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "d5c28994b2c1440480fccd0b6c2ce72c23bb9fff", "versionType": "git"}, {"status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "9af312d3607c8f9b5166a19cbf40cee351cc3a1d", "versionType": "git"}, {"status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "dda5245afc3470d70406764e3d9f5508e534920a", "versionType": "git"}, {"status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7", "versionType": "git"}, {"status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "f641066b0ddcd1b0cf007c0d04f9c966f6e888ae", "versionType": "git"}, {"status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "8c4f962f368d5e17481f3c2c5a43028953e137a5", "versionType": "git"}, {"status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "db7b86bd97b380ece8fa39cfdd7502a9fd35e56f", "versionType": "git"}], "programFiles": ["drivers/net/wireless/intersil/p54/fwio.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.24", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.273", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.224", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.161", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.115", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.59", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.13", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/intersil/p54/fwio.c"], "defaultStatus": "affected"}]}], "published": "2026-10-28T04:18:07.417", "references": [{"url": "https://git.kernel.org/stable/c/87a9aba92485889d510052e474999a6ec00b888c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9af312d3607c8f9b5166a19cbf40cee351cc3a1d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d5c28994b2c1440480fccd0b6c2ce72c23bb9fff", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dda5245afc3470d70406764e3d9f5508e534920a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state."}], "lastModified": "2026-11-01T13:18:01.873", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}