SB20261029217 - Out-of-bounds read in Linux kernel intersil p54 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-99100)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering out-of-bounds reads in the kernel.

The vulnerability exists due to out-of-bounds reads in the Linux kernel p54 firmware parser when processing firmware records without verifying that their lengths cover the accessed fields. A local privileged user can cause specially crafted firmware containing undersized records to be parsed to trigger reads beyond record boundaries, potentially crashing the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5
• https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f
• https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae