« Volver al listado

CVE-2026-98188

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate curve data length in the calibration curve converters

p54_convert_rev0() and p54_convert_rev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54_convert_output_limits() and p54_convert_db() already validate their counts against the entry length; this path was missed.

Leer descripción completaMostrar menos

Reject the entry when the counts do not fit in the entry data.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98188",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
              "lessThan": "81084c967c18233b19799a0c3352ebac043f31e2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
              "lessThan": "41cdf14bf4b52fbe4673a172c2a6ad756cb08111",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
              "lessThan": "03d313e3dfb49a44c10a5c423452967694fb85e2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
              "lessThan": "42f4b03971f9d6329c4cbd1ea5155210d16ab65b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
              "lessThan": "4d767d6f8753db22bfc14c2724bd9cee677ffb03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
              "lessThan": "3bdcc4d61212b001b8752d80036509b4974ce16c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
              "lessThan": "b0c906107150b16925ee66da09127259864c7f36",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
              "lessThan": "ce858fa6b8a214dee5adb82358885fa024cdd887",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/intersil/p54/eeprom.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.24",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/intersil/p54/eeprom.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:18:03.867",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/03d313e3dfb49a44c10a5c423452967694fb85e2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3bdcc4d61212b001b8752d80036509b4974ce16c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/41cdf14bf4b52fbe4673a172c2a6ad756cb08111",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/42f4b03971f9d6329c4cbd1ea5155210d16ab65b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4d767d6f8753db22bfc14c2724bd9cee677ffb03",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/81084c967c18233b19799a0c3352ebac043f31e2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b0c906107150b16925ee66da09127259864c7f36",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ce858fa6b8a214dee5adb82358885fa024cdd887",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate curve data length in the calibration curve converters\n\np54_convert_rev0() and p54_convert_rev1() read calibration curve\ndata from the device-supplied EEPROM entry using channel and\npoints-per-channel counts taken verbatim from that same entry, so\nan entry that declares more data than it carries drives an\nout-of-bounds read past the EEPROM buffer (verified with a KASAN\nreproducer of the conversion loop). The sibling converters\np54_convert_output_limits() and p54_convert_db() already validate\ntheir counts against the entry length; this path was missed.\n\nReject the entry when the counts do not fit in the entry data."
    }
  ],
  "lastModified": "2026-10-06T09:18:03.867",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}