The Linux kernel’s p54 Wi‑Fi driver contains an out‑of‑bounds read flaw in the PDR_INTERFACE_LIST parsing loop. The loop checks the record start but then reads an entire exp_if structure; a truncated trailing record causes the driver to read past the end of the EEPROM buffer, leaking heap data. The variant field read also feeds the synthesizer front‑end selection, meaning the bug can leak memory contents and alter driver behavior.

All Linux kernel releases that include the vulnerable p54 Wi‑Fi driver before the referenced commits are affected. The specific kernel version numbers are not listed in the CVE data, so any system using the driver prior to the fix is at risk.

The CVSS score of 5.5 indicates medium severity, and the EPSS score is below 1%, implying a low probability of exploitation. Not listed in the CISA KEV catalog. Exploitation would likely require a crafted packet or environment that forces the driver to parse a truncated PDR_INTERFACE_LIST record, which could be achieved from a nearby device or compromised firmware, making the attack vector probable via the Wi‑Fi interface and potentially local or remote. The outcome may be the leakage of sensitive data or manipulation of driver behavior.