CVE-2026-64571

A flaw was found in the Linux kernel's wifi: p54 component. A local attacker with a malicious USB device could exploit this by sending a specially crafted frame during an EEPROM (Electrically Erasable Programmable Read-Only Memory) readback operation. This vulnerability allows the device to read beyond the intended buffer, potentially disclosing sensitive information from adjacent memory.

A moderate information-disclosure vulnerability was found in the Linux kernel p54 wireless (Intersil Prism54) driver. The p54_rx_eeprom_readback() function copies a requested EEPROM slice out of a device-supplied readback frame without verifying that the received socket buffer actually holds that many bytes. A malicious USB device can send a truncated frame whose advertised length matches the expected slice size, so the existing length-equality check passes and the memcpy() reads past the end of the allocated buffer, disclosing adjacent kernel heap memory and potentially causing a kernel oops or panic (a KASAN slab-out-of-bounds report). Exploitation requires physical access to the system in order to attach a malicious p54 USB device. Red Hat rates the impact of this flaw as Moderate. All currently tracked Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are not affected because the vulnerable code is not present in the shipped kernel packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.