CVE-2026-64571

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

p54_rx_eeprom_readback() copies the requested EEPROM slice out of a

device-supplied readback frame without checking that the skb actually holds

that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in

p54_rx_eeprom_readback()") closed the destination overflow by copying a

fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len),

but the source side is still unbounded: nothing verifies the frame is long

enough to supply that many bytes.

A malicious USB device can send a short frame whose advertised len matches

priv->eeprom_slice_size while the payload is truncated. The equality check

passes and memcpy() reads past the end of the skb, leaking adjacent heap:

BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507)

Read of size 1016 at addr ffff88800f077114 by task swapper/0/0

Call T

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References