AZL-106362
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106362.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-106362
- Upstream
- Published
- 2026-10-06T09:18:03Z
- Modified
- 2026-10-08T05:35:32Z
- Summary
- CVE-2026-98187 affecting package kernel 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
The PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if from it. A truncated trailing record makes the if_id/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak.
Advance only while a full record still fits in the entry.
- References