Firmware Length Validation Issue in Linux Kernel's p54 Driver by Linux Foundation

CVE-2026-99100

What is CVE-2026-99100?

A vulnerability in the p54 firmware parser of the Linux kernel allows for potential exploitation due to inadequate validation of firmware record lengths. Specifically, when accessing component ID and version records, the parser does not confirm that the lengths are sufficient for the data being read. This oversight can permit a malformed firmware record to cause the parser to read beyond the intended boundaries, posing risks to system integrity. To mitigate this, it is crucial to implement thorough checks on the lengths of component records and to reject any descriptor values that would lead to underflow or empty ranges before updating the driver's state.

References