Executive brief
A vulnerability in the Linux kernel's Intel Wi-Fi driver (iwlwifi) could allow a malicious or compromised firmware to cause a system crash or memory corruption. The issue occurs when the driver incorrectly processes memory configuration data for certain Intel 22000 series wireless adapters. This could lead to a loss of system availability or potentially allow unauthorized access to sensitive data on the affected device.
Technical details
An array out-of-bounds (overrun) vulnerability exists in the Linux kernel's iwlwifi driver, specifically within the 'iwl_parse_shared_mem_22000' function in 'drivers/net/wireless/intel/iwlwifi/fw/smem.c'. The root cause is insufficient validation of the number of Lower MAC (LMAC) units reported by the device firmware. If the firmware reports more than two LMACs, the driver attempts to access 'fwrt->smem_cfg.lmac[2]', which exceeds the allocated array size. This can be exploited by a compromised firmware to corrupt kernel memory. The fix introduces 'IWL_FW_CHECK' to properly validate the 'lmac_num' against the 'ARRAY_SIZE' of the destination buffer.
Affected products
- Linux Linux Kernel 5.8 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-11-10: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-06: advisory