CVE-2026-64571
Description
A flaw was found in the Linux kernel's wifi: p54 component. A local attacker with a malicious USB device could exploit this by sending a specially crafted frame during an EEPROM (Electrically Erasable Programmable Read-Only Memory) readback operation. This vulnerability allows the device to read beyond the intended buffer, potentially disclosing sensitive information from adjacent memory.
Statement
A moderate information-disclosure vulnerability was found in the Linux kernel p54 wireless (Intersil Prism54) driver. The p54_rx_eeprom_readback() function copies a requested EEPROM slice out of a device-supplied readback frame without verifying that the received socket buffer actually holds that many bytes. A malicious USB device can send a truncated frame whose advertised length matches the expected slice size, so the existing length-equality check passes and the memcpy() reads past the end of the allocated buffer, disclosing adjacent kernel heap memory and potentially causing a kernel oops or panic (a KASAN slab-out-of-bounds report). Exploitation requires physical access to the system in order to attach a malicious p54 USB device. Red Hat rates the impact of this flaw as Moderate. All currently tracked Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are not affected because the vulnerable code is not present in the shipped kernel packages.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
