{"api_version":"1","generated_at":"2026-10-28T08:01:11+00:00","cve":"CVE-2026-99100","urls":{"html":"https://cve.report/CVE-2026-99100","api":"https://cve.report/api/cve/CVE-2026-99100.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99100","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99100"},"summary":{"title":"wifi: p54: validate firmware record lengths","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-28 04:18:07","updated_at":"2026-10-28 04:18:07"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5","name":"https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae","name":"https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f","name":"https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99100","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99100","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 f641066b0ddcd1b0cf007c0d04f9c966f6e888ae git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 8c4f962f368d5e17481f3c2c5a43028953e137a5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 db7b86bd97b380ece8fa39cfdd7502a9fd35e56f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.59 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.2.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.59 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.13 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/intersil/p54/fwio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f641066b0ddcd1b0cf007c0d04f9c966f6e888ae","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8c4f962f368d5e17481f3c2c5a43028953e137a5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"db7b86bd97b380ece8fa39cfdd7502a9fd35e56f","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6.18.59","status":"affected","version":"0","versionType":"semver"},{"lessThan":"7.2.13","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/intersil/p54/fwio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.59","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.59","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state."}],"providerMetadata":{"dateUpdated":"2026-10-28T03:55:38.898Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae"},{"url":"https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5"},{"url":"https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f"}],"title":"wifi: p54: validate firmware record lengths","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99100","datePublished":"2026-10-28T03:55:38.898Z","dateReserved":"2026-09-25T10:25:14.391Z","dateUpdated":"2026-10-28T03:55:38.898Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-28 04:18:07","lastModifiedDate":"2026-10-28 04:18:07","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99100","Ordinal":"1","Title":"wifi: p54: validate firmware record lengths","CVE":"CVE-2026-99100","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99100","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state.","Type":"Description","Title":"wifi: p54: validate firmware record lengths"}]}}}