CVE-2026-64571 in Linux
Summary
by MITRE • 08/05/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()") closed the destination overflow by copying a fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len), but the source side is still unbounded: nothing verifies the frame is long enough to supply that many bytes.
A malicious USB device can send a short frame whose advertised len matches priv->eeprom_slice_size while the payload is truncated. The equality check passes and memcpy() reads past the end of the skb, leaking adjacent heap:
BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) Read of size 1016 at addr ffff88800f077114 by task swapper/0/0 Call Trace: <IRQ> ... __asan_memcpy (mm/kasan/shadow.c:105) p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005) ... </IRQ>
The buggy address belongs to the object at ffff88800f0770c0 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 84 bytes inside of allocated 704-byte region [ffff88800f0770c0, ffff88800f077380)
Check that the slice fits in the skb before copying.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability resides within the linux kernel's wireless subsystem specifically in the p54 driver responsible for handling USB-based wifi devices manufactured by intersil. This flaw manifests in the function p54_rx_eeprom_readback() which processes EEPROM readback frames received from usb devices. The core issue stems from inadequate validation of received frame lengths before copying data into memory buffers, creating a potential out-of-bounds memory access condition that could lead to information disclosure or system instability.
The technical flaw involves a classic buffer over-read scenario where the driver copies data from a device-supplied readback frame without verifying that the frame contains sufficient bytes to satisfy the requested EEPROM slice size. While commit da1b9a55ff11 addressed the destination buffer overflow by implementing fixed size copying, it failed to validate the source frame length, leaving the system vulnerable to maliciously crafted short frames. The vulnerability specifically affects memory operations in drivers/net/wireless/intersil/p54/txrx.c at line 507 where memcpy() executes without bounds checking against the actual skb payload length.
An attacker exploiting this vulnerability can craft a malicious USB device that sends a readback frame with an advertised length matching the expected eeprom_slice_size while providing truncated payload data. The equality check passes because the frame length matches expectations, but the actual data contained is insufficient. This allows memcpy() to read beyond the allocated skb buffer boundaries, resulting in heap memory leakage as evidenced by the kasan error reporting slab-out-of-bounds access. The memory leak occurs at address ffff88800f077114 which belongs to a skbuff_small_head cache object, indicating that adjacent heap memory contents are being inadvertently accessed and potentially leaked.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks through memory corruption. The out-of-bounds read could expose sensitive kernel memory contents including cryptographic keys, network credentials, or other confidential data stored in adjacent memory regions. This represents a critical security concern for systems running vulnerable kernel versions where usb wifi devices are present, as the attack requires only physical access to introduce malicious hardware rather than complex network-based exploitation techniques. The vulnerability aligns with CWE-129 Input Validation and Output Processing, specifically addressing improper validation of buffer sizes in memory operations, and maps to ATT&CK technique T1059 Command and Scripting Interpreter for potential exploitation through kernel-level code execution pathways.
Mitigation strategies should focus on implementing comprehensive input validation before any data copying operations occur. The fix requires adding explicit length verification checks that ensure the received skb frame contains sufficient bytes to satisfy the requested EEPROM slice size before proceeding with memory operations. System administrators should deploy updated kernel versions containing the patched implementation immediately, as the vulnerability affects all systems running impacted kernel versions where usb wifi devices are present. Additionally, hardware-level mitigations such as usb device whitelisting and runtime monitoring of suspicious usb device behavior can provide additional defense-in-depth measures against exploitation attempts targeting this specific vulnerability class.