The bug in the Linux kernel’s p54 Wi‑Fi driver allows an attacker to trigger an out‑of‑bounds read when a device supplies a calibration curve entry that claims more data than it actually contains. The driver copies channel and points‑per‑channel counts directly from the entry and then reads past the end of the EEPROM buffer during the conversion loop, producing a kernel memory read error. The flaw is a classic example of improper input validation and buffer over‑read.

The vulnerability exists in any Linux kernel configuration that contains the p54 Wi‑Fi driver, which is part of the mainline kernel source. No specific kernel release is enumerated in the advisory, so all builds that ship the affected driver code are potentially vulnerable. The flaw is limited to systems that use the p54 hardware or a device that loads the driver.

The CVSS score of 5.5 indicates a medium potential impact. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation in the wild. The attack requires access to a device that can supply a malicious EEPROM or firmware image, meaning the threat is primarily local or requires physical access. The flaw leads only to a kernel out-of-bounds read and does not provide a code execution path.