CVE-2026-98188 - Vulnerability Details

- wifi: p54: validate curve data length in the calibration curve converters

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate curve data length in the calibration curve converters

p54_convert_rev0() and p54_convert_rev1() read calibration curve
data from the device-supplied EEPROM entry using channel and
points-per-channel counts taken verbatim from that same entry, so
an entry that declares more data than it carries drives an
out-of-bounds read past the EEPROM buffer (verified with a KASAN
reproducer of the conversion loop). The sibling converters
p54_convert_output_limits() and p54_convert_db() already validate
their counts against the entry length; this path was missed.

Reject the entry when the counts do not fit in the entry data.

Published: 2026-10-06

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`eff1a59c48e3c6a006eb4fe5f2e405a996f2259d`	affected	< 81084c967c18233b19799a0c3352ebac043f31e2
`eff1a59c48e3c6a006eb4fe5f2e405a996f2259d`	affected	< 41cdf14bf4b52fbe4673a172c2a6ad756cb08111
`eff1a59c48e3c6a006eb4fe5f2e405a996f2259d`	affected	< 03d313e3dfb49a44c10a5c423452967694fb85e2
`eff1a59c48e3c6a006eb4fe5f2e405a996f2259d`	affected	< 42f4b03971f9d6329c4cbd1ea5155210d16ab65b
`eff1a59c48e3c6a006eb4fe5f2e405a996f2259d`	affected	< 4d767d6f8753db22bfc14c2724bd9cee677ffb03
`eff1a59c48e3c6a006eb4fe5f2e405a996f2259d`	affected	< 3bdcc4d61212b001b8752d80036509b4974ce16c
`eff1a59c48e3c6a006eb4fe5f2e405a996f2259d`	affected	< b0c906107150b16925ee66da09127259864c7f36
`eff1a59c48e3c6a006eb4fe5f2e405a996f2259d`	affected	< ce858fa6b8a214dee5adb82358885fa024cdd887

Linux

affected

Version	Status	Constraints
`2.6.24`	affected	—
`0`	unaffected	< 2.6.24
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3-rc4`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[eff1a59c48e3c6a006eb4fe5f2e405a996f2259d,81084c967c18233b19799a0c3352ebac043f31e2)`	affected	code_commit	—
`[eff1a59c48e3c6a006eb4fe5f2e405a996f2259d,41cdf14bf4b52fbe4673a172c2a6ad756cb08111)`	affected	code_commit	—
`[eff1a59c48e3c6a006eb4fe5f2e405a996f2259d,03d313e3dfb49a44c10a5c423452967694fb85e2)`	affected	code_commit	—
`[eff1a59c48e3c6a006eb4fe5f2e405a996f2259d,42f4b03971f9d6329c4cbd1ea5155210d16ab65b)`	affected	code_commit	—
`[eff1a59c48e3c6a006eb4fe5f2e405a996f2259d,4d767d6f8753db22bfc14c2724bd9cee677ffb03)`	affected	code_commit	—
`[eff1a59c48e3c6a006eb4fe5f2e405a996f2259d,3bdcc4d61212b001b8752d80036509b4974ce16c)`	affected	code_commit	—
`[eff1a59c48e3c6a006eb4fe5f2e405a996f2259d,b0c906107150b16925ee66da09127259864c7f36)`	affected	code_commit	—
`[eff1a59c48e3c6a006eb4fe5f2e405a996f2259d,ce858fa6b8a214dee5adb82358885fa024cdd887)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.24`	affected	semver	—
`[0,2.6.24)`	unaffected	semver	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03d313e3dfb49a44c10a5c423452967694fb85e2
https://git.kernel.org/stable/c/3bdcc4d61212b001b8752d80036509b4974ce16c
https://git.kernel.org/stable/c/41cdf14bf4b52fbe4673a172c2a6ad756cb08111
https://git.kernel.org/stable/c/42f4b03971f9d6329c4cbd1ea5155210d16ab65b
https://git.kernel.org/stable/c/4d767d6f8753db22bfc14c2724bd9cee677ffb03
https://git.kernel.org/stable/c/81084c967c18233b19799a0c3352ebac043f31e2
https://git.kernel.org/stable/c/b0c906107150b16925ee66da09127259864c7f36
https://git.kernel.org/stable/c/ce858fa6b8a214dee5adb82358885fa024cdd887

History

Tue, 06 Oct 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-20

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54_convert_rev0() and p54_convert_rev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54_convert_output_limits() and p54_convert_db() already validate their counts against the entry length; this path was missed. Reject the entry when the counts do not fit in the entry data.
Title		wifi: p54: validate curve data length in the calibration curve converters
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03d313e3dfb49a44c10a5c423452967694fb85e2 https://git.kernel.org/stable/c/3bdcc4d61212b001b8752d80036509b4974ce16c https://git.kernel.org/stable/c/41cdf14bf4b52fbe4673a172c2a6ad756cb08111 https://git.kernel.org/stable/c/42f4b03971f9d6329c4cbd1ea5155210d16ab65b https://git.kernel.org/stable/c/4d767d6f8753db22bfc14c2724bd9cee677ffb03 https://git.kernel.org/stable/c/81084c967c18233b19799a0c3352ebac043f31e2 https://git.kernel.org/stable/c/b0c906107150b16925ee66da09127259864c7f36 https://git.kernel.org/stable/c/ce858fa6b8a214dee5adb82358885fa024cdd887

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:44:30.096Z

Updated: 2026-10-06T08:44:30.096Z

Reserved: 2026-09-25T10:25:14.323Z

Link: CVE-2026-98188

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:03.867

Modified: 2026-10-06T09:18:03.867

Link: CVE-2026-98188

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-06T16:00:03Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-20
Improper Input Validation

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object