CVE Tools
Track your stack

CVE-2026-98187

wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.

CVSS —Not scoredEPSS percentile7th0.2% chance in 30 daysCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix1 product4 fixed builds listed below

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • LinuxAffected: ≥ eff1a59c48e3c6a006eb4fe5f2e405a996f2259d, < 162dbe1c285a621eab6a9f2851086b63a0378928Upgrade to: 162dbe1c285a621eab6a9f2851086b63a0378928Affected: ≥ eff1a59c48e3c6a006eb4fe5f2e405a996f2259d, < 70bf34b425fe549a4f6a8d50a319f8f05d1f91c9Upgrade to: 70bf34b425fe549a4f6a8d50a319f8f05d1f91c9Affected: ≥ eff1a59c48e3c6a006eb4fe5f2e405a996f2259d, < 487f966421014de41e835bbce3feb30b35f4f729Upgrade to: 487f966421014de41e835bbce3feb30b35f4f729Affected: ≥ eff1a59c48e3c6a006eb4fe5f2e405a996f2259d, < bc83c04be042f53869c315b8e1eb5f124959d1d7Upgrade to: bc83c04be042f53869c315b8e1eb5f124959d1d7 + 4 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST The PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if from it. A truncated trailing record makes the if_id/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak. Advance only while a full record still fits in the entry.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS7th
CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

2 events over 0 days, from the signal feeds we watch.

  1. Publishedrecord updated

Affected products

Sources

References in the record

And 5 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.