CVE-2026-64571: Linux Kernel p54 Buffer Overflow Flaw

CVE-2026-64571 Overview

CVE-2026-64571 is an out-of-bounds read vulnerability in the Linux kernel p54 wireless driver. The flaw resides in p54_rx_eeprom_readback() inside drivers/net/wireless/intersil/p54/txrx.c. The function copies an EEPROM slice from a device-supplied readback frame without validating that the socket buffer (skb) actually contains enough bytes. A malicious USB device can advertise a length matching priv->eeprom_slice_size while delivering a truncated payload, causing memcpy() to read past the end of the skb and leak adjacent kernel heap memory.

Critical Impact
A malicious or compromised USB Wi-Fi adapter using the p54 chipset can trigger a heap out-of-bounds read in the kernel, leaking adjacent slab memory and enabling further exploitation.

Affected Products

Linux kernel versions prior to the fix commits in the p54 intersil wireless driver
Systems using p54-family USB Wi-Fi adapters via the p54usb driver
Distributions shipping the vulnerable drivers/net/wireless/intersil/p54/txrx.c code path

Discovery Timeline

2026-08-05 - CVE-2026-64571 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64571

Vulnerability Analysis

The p54_rx_eeprom_readback() function processes readback frames from p54 wireless devices to retrieve EEPROM contents. A prior fix, commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()"), addressed the destination side by copying a fixed priv->eeprom_slice_size and rejecting mismatched advertised lengths. That patch left the source side unchecked. The code never verifies that the incoming skb payload is at least as large as the slice being copied. This is classified as an out-of-bounds read [CWE-125] in kernel-controlled slab memory.

Root Cause

The root cause is missing input validation on device-supplied frame length. The equality check between the advertised length and priv->eeprom_slice_size passes even when the actual skb payload is truncated. The subsequent memcpy() then reads priv->eeprom_slice_size bytes from an skb that holds fewer bytes, producing a slab out-of-bounds read as reported by KASAN in the skbuff_small_head cache.

Attack Vector

Exploitation requires an attacker-controlled USB device that identifies as a p54-supported wireless adapter. Once attached, the device sends a crafted readback frame whose advertised slice length matches priv->eeprom_slice_size while the actual frame payload is shorter. The KASAN report shows the read occurring during URB completion via p54u_rx_cb() and __usb_hcd_giveback_urb(). The read of size 1016 bytes past the allocated 704-byte slab region can leak neighboring heap contents to the driver, and in turn to userspace or wireless management interfaces that consume the returned data.

No public proof-of-concept exploit code is available. The vulnerability mechanism is described in the kernel commit messages referenced below.

Detection Methods for CVE-2026-64571

Indicators of Compromise

KASAN reports of slab-out-of-bounds in p54_rx at drivers/net/wireless/intersil/p54/txrx.c on kernels built with CONFIG_KASAN
Kernel log entries referencing p54u_rx_cb combined with unexpected skb length anomalies
Presence of unknown or unauthorized USB devices enumerating as p54-family wireless adapters

Detection Strategies

Monitor dmesg and journalctl -k output for KASAN or memory-corruption warnings originating in p54 or p54usb
Audit USB device enumeration events for wireless adapters using vendor and product IDs handled by the p54usb driver
Review kernel version inventories to identify hosts running unpatched p54 code paths

Monitoring Recommendations

Enable USB device connection logging via udev and forward events to a centralized log platform
Alert on kernel oops, panic, or KASAN messages from wireless subsystem modules
Track host uptime and kernel package versions to confirm patch deployment coverage

How to Mitigate CVE-2026-64571

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and rebuild or update affected kernels
Restrict physical and logical USB access on systems where p54 adapters are not required
Unload the p54usb module on hosts that do not need p54-based wireless connectivity using modprobe -r p54usb

Patch Information

The fix adds a length check to ensure the requested slice fits within the received skb before invoking memcpy(). The patch has been applied across multiple stable branches. See the upstream commits: 25c3b85af3fc, 9096e1f70141, d38f5d868a0a, ebd6d37fa94b, and f46f8f9c43fd.

Workarounds

Blacklist the p54usb kernel module on systems that do not require p54 wireless hardware
Enforce USB device allowlisting via USBGuard or equivalent controls to block unknown wireless adapters
Physically disable or remove USB ports on high-value systems where removable wireless devices are not needed

bash

# Blacklist the vulnerable driver on systems that do not need it
echo "blacklist p54usb" | sudo tee /etc/modprobe.d/blacklist-p54usb.conf
sudo modprobe -r p54usb
sudo update-initramfs -u