CVE-2026-99100

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99100", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.391Z", "datePublished": "2026-10-28T03:55:38.898Z", "dateUpdated": "2026-11-01T12:42:04.550Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-01T12:42:04.550Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intersil/p54/fwio.c"], "versions": [{"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "87a9aba92485889d510052e474999a6ec00b888c", "status": "affected", "versionType": "git"}, {"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "d5c28994b2c1440480fccd0b6c2ce72c23bb9fff", "status": "affected", "versionType": "git"}, {"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "9af312d3607c8f9b5166a19cbf40cee351cc3a1d", "status": "affected", "versionType": "git"}, {"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "dda5245afc3470d70406764e3d9f5508e534920a", "status": "affected", "versionType": "git"}, {"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7", "status": "affected", "versionType": "git"}, {"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "f641066b0ddcd1b0cf007c0d04f9c966f6e888ae", "status": "affected", "versionType": "git"}, {"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "8c4f962f368d5e17481f3c2c5a43028953e137a5", "status": "affected", "versionType": "git"}, {"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "lessThan": "db7b86bd97b380ece8fa39cfdd7502a9fd35e56f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intersil/p54/fwio.c"], "versions": [{"version": "2.6.24", "status": "affected"}, {"version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/87a9aba92485889d510052e474999a6ec00b888c"}, {"url": "https://git.kernel.org/stable/c/d5c28994b2c1440480fccd0b6c2ce72c23bb9fff"}, {"url": "https://git.kernel.org/stable/c/9af312d3607c8f9b5166a19cbf40cee351cc3a1d"}, {"url": "https://git.kernel.org/stable/c/dda5245afc3470d70406764e3d9f5508e534920a"}, {"url": "https://git.kernel.org/stable/c/f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7"}, {"url": "https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae"}, {"url": "https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5"}, {"url": "https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f"}], "title": "wifi: p54: validate firmware record lengths", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/intersil/p54/fwio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "87a9aba92485889d510052e474999a6ec00b888c", "status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "versionType": "git"}, {"lessThan": "d5c28994b2c1440480fccd0b6c2ce72c23bb9fff", "status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "versionType": "git"}, {"lessThan": "9af312d3607c8f9b5166a19cbf40cee351cc3a1d", "status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "versionType": "git"}, {"lessThan": "dda5245afc3470d70406764e3d9f5508e534920a", "status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "versionType": "git"}, {"lessThan": "f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7", "status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "versionType": "git"}, {"lessThan": "f641066b0ddcd1b0cf007c0d04f9c966f6e888ae", "status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "versionType": "git"}, {"lessThan": "8c4f962f368d5e17481f3c2c5a43028953e137a5", "status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "versionType": "git"}, {"lessThan": "db7b86bd97b380ece8fa39cfdd7502a9fd35e56f", "status": "affected", "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/intersil/p54/fwio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"lessThan": "2.6.24", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state."}], "id": "CVE-2026-99100", "lastModified": "2026-11-01T13:18:01.873", "metrics": {}, "published": "2026-10-28T04:18:07.417", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87a9aba92485889d510052e474999a6ec00b888c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9af312d3607c8f9b5166a19cbf40cee351cc3a1d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d5c28994b2c1440480fccd0b6c2ce72c23bb9fff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dda5245afc3470d70406764e3d9f5508e534920a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: p54: validate firmware record lengths", "id": "2562569", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562569"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: p54: validate firmware record lengths\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state.", "A flaw was found in the Linux kernel's p54 wireless driver. This vulnerability can lead to a denial of service (DoS) or kernel information disclosure. The issue occurs because the firmware parser does not properly validate record lengths before reading component data. A local user capable of loading a crafted firmware file could trigger an out-of-bounds read, causing a system crash or leaking kernel memory."], "name": "CVE-2026-99100", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99100\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99100\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99100.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f641066b0ddcd1b0cf007c0d04f9c966f6e888ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8c4f962f368d5e17481f3c2c5a43028953e137a5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,db7b86bd97b380ece8fa39cfdd7502a9fd35e56f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.59)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f641066b0ddcd1b0cf007c0d04f9c966f6e888ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8c4f962f368d5e17481f3c2c5a43028953e137a5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,db7b86bd97b380ece8fa39cfdd7502a9fd35e56f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.59)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T05:45:14.947824+00:00", "updated": "2026-10-29T19:45:11.726521+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}