Executive brief
A vulnerability exists in the Linux kernel's Intel Wi-Fi driver (iwlwifi) that could allow an attacker to read sensitive information from the system's memory. This occurs during the processing of Wi-Fi scan results when the system is in a low-power state. An exploit could lead to the exposure of kernel data or cause a system crash, potentially impacting the confidentiality and availability of the device.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the iwl_mvm_nd_match_info_handler() function within the iwlwifi driver (drivers/net/wireless/intel/iwlwifi/mvm/d3.c). The root cause is insufficient validation of the packet length before performing a memcpy operation from the dynamic array 'notif->matches'. An attacker within radio range (adjacent) could potentially provide a malformed notification packet that triggers a read beyond the allocated buffer. This can result in the leakage of kernel memory or a denial-of-service (system crash). The issue has been addressed by extending the length check to include the size of the matches array. Patches are available for multiple stable kernel branches including 6.1.y, 6.6.y, 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.1 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-02-07: other: Vulnerability identified and patch authored
- 2026-05-01: disclosed: CVE published
- 2026-05-01: advisory: NVD entry created
References
- https://git.kernel.org/stable/c/744fabc338e87b95c4d1ff7c95bc8c0f834c6d99
- https://git.kernel.org/stable/c/ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2
- https://git.kernel.org/stable/c/dd90880eb5ec5442b37eb2b95688f4a63f4883e3
- https://git.kernel.org/stable/c/e67d8c626ace80b0fa2b48c8ec0a46b508c93442
- https://git.kernel.org/stable/c/f6abac936a0dfd31d6c3e49205ec0ee75a8f887f
- https://git.kernel.org/stable/c/ffbed27ba15ef80d1c622eeedbfef03e501ae134