Buffer Overflow Vulnerability in Linux Kernel's p54 WiFi Driver
Summary
CVE-2025-38348: In the Linux kernel, the following vulnerability has been resolved: wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() Robert Morris reported: |If a malicious USB device pretends to be an Intersil p54 wifi |i... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core of many operating systems, providing essential services for hardware and software interaction. The p54 driver is responsible for managing Intersil p54 WiFi interfaces, enabling wireless connectivity. This driver is crucial for devices relying on this specific chipset, but it is vulnerable to a buffer overflow issue that can be exploited by malicious USB devices.
Vulnerability Detail
In the Linux kernel, a buffer overflow vulnerability exists in the p54 driver, specifically in the p54_rx_eeprom_readback() function. This vulnerability arises when a malicious USB device masquerades as an Intersil p54 WiFi interface, sending an eeprom_readback message with an oversized length. This can lead to the copying of data beyond the allocated memory, potentially causing crashes or system instability. The vulnerability was reported by Robert Morris, highlighting the risks associated with tampered data lengths from the device.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid connecting potentially malicious USB devices that may exploit this vulnerability. Additionally, monitoring the firmware version and ensuring it is from a trusted source can help mitigate risks.
Conclusion
The buffer overflow vulnerability in the Linux kernel's p54 WiFi driver poses significant risks, especially when exploited by malicious USB devices. Users are encouraged to update their systems to the latest patched version to mitigate these risks and ensure ongoing security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38348 is a buffer overflow vulnerability in the Linux kernel's p54 WiFi driver that can be exploited by malicious USB devices.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. It allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Exploitation of this vulnerability can lead to system crashes, instability, or unauthorized access, depending on the attacker's intent.
Yes, a patch is available for Debian 13 in version 6.12.35-1. Users should update their Linux package to this version or later.
If immediate updates are not possible, avoid connecting untrusted USB devices and monitor your system for unusual behavior.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
