A buffer read overflow in the kernel’s p54 Wi‑Fi driver allows a malicious USB device to send a short frame whose advertised length matches the expected EEPROM slice size. Because the driver does not verify that the received data actually contains the advertised number of bytes, a call to memcpy() reads past the end of the socket buffer, exposing adjacent heap memory. This unchecked source length flaw can leak kernel data and provide a foothold for further exploitation, such as arbitrary code execution in kernel mode, given adequate privileges to craft the frame.

Any Linux system that includes the Intersil p54 Wi‑Fi driver is potentially affected. The driver is part of the mainline kernel; no specific kernel versions are listed in the advisory, so any kernel containing this driver component should be considered vulnerable.

The vulnerability’s severity stems from an uncontrolled kernel‑mode memory read (CWE‑125). The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. An attacker would need the ability to supply a specially crafted USB frame to the device, implying physical or local USB access as the primary attack vector. If the compromised system’s kernel is patched, the risk is mitigated; otherwise, the flaw remains a significant kernel‑level security risk.