CVE-2026-98187

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

The PDR_INTERFACE_LIST loop only checks that the record start is within

the entry before reading an entire struct exp_if from it. A truncated

trailing record makes the if_id/variant reads cross the entry boundary

into the heap beyond the EEPROM buffer (verified with a KASAN

reproducer of the loop). The variant also feeds the synth front-end

selection, so this is not only a leak.

Advance only while a full record still fits in the entry.