# wifi: p54: validate firmware record lengths

CVE record · `CVE-2026-99100`

- **Identifiers:** `CVE-2026-99100`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 28 Oct 2026
- **Updated:** 1 Nov 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 28 Oct 2026, 03:55 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to before 87a9aba92485889d510052e474999a6ec00b888c` (git)
  - affected: `eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to before d5c28994b2c1440480fccd0b6c2ce72c23bb9fff` (git)
  - affected: `eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to before 9af312d3607c8f9b5166a19cbf40cee351cc3a1d` (git)
  - affected: `eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to before dda5245afc3470d70406764e3d9f5508e534920a` (git)
  - affected: `eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to before f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7` (git)
  - affected: `eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to before f641066b0ddcd1b0cf007c0d04f9c966f6e888ae` (git)
  - affected: `eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to before 8c4f962f368d5e17481f3c2c5a43028953e137a5` (git)
  - affected: `eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to before db7b86bd97b380ece8fa39cfdd7502a9fd35e56f` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `2.6.24`
  - unaffected: `before 2.6.24` (semver)
  - unaffected: `5.10.273 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.224 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.161 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.115 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.59 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.13 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0016, the 5th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

- 28 Oct 2026, 03:55 UTC: [Confirmed by the CVE List](https://www.cve.org/CVERecord?id=CVE-2026-99100)
- 28 Oct 2026, 04:18 UTC: [Confirmed by NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-99100)

## Sources

- [CVE List: CVE-2026-99100](https://www.cve.org/CVERecord?id=CVE-2026-99100)
- [NVD: CVE-2026-99100](https://nvd.nist.gov/vuln/detail/CVE-2026-99100)

### References from the CNA

- <https://git.kernel.org/stable/c/87a9aba92485889d510052e474999a6ec00b888c>
- <https://git.kernel.org/stable/c/d5c28994b2c1440480fccd0b6c2ce72c23bb9fff>
- <https://git.kernel.org/stable/c/9af312d3607c8f9b5166a19cbf40cee351cc3a1d>
- <https://git.kernel.org/stable/c/dda5245afc3470d70406764e3d9f5508e534920a>
- <https://git.kernel.org/stable/c/f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7>
- <https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae>
- <https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5>
- <https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-99100>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-99100/>. Everything for agents: <https://agentprime.io/llms.txt>.