CVE-2026-98188 wifi: p54: validate curve data length in the calibration curve converters
A missing length validation in the Linux kernel p54 WiFi driver allows an attacker with physical access to trigger an out-of-bounds read via a malicious EEPROM, potentially causing a crash or information leak.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98188?
CVE-2026-98188 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: validate curve data length in the calibration curve converters
p54_convert_rev0() and p54_convert_rev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54_convert_output_limits() and p54_convert_db() already validate their counts against the entry length; this path was missed.
Reject the entry when the counts do not fit in the entry data.
Which versions are affected by CVE-2026-98188?
How do I fix CVE-2026-98188?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98188 being exploited?
There is no known exploitation of CVE-2026-98188 in the wild and no public exploit code.
Sources
Also known as AZL-105999, BELL-CVE-2026-98188, DEBIAN-CVE-2026-98188, GHSA-4pxx-93w9-mj25, UBUNTU-CVE-2026-98188.