Executive brief
A vulnerability in the Linux kernel's Intel Wi-Fi driver (iwlwifi) could lead to a system crash or instability. The issue occurs when the driver handles certain wireless session data incorrectly, potentially causing the system to access memory it shouldn't. This primarily affects devices using Intel wireless hardware running specific versions of the Linux operating system.
Technical details
An out-of-bounds access vulnerability exists in the Linux kernel's iwlwifi driver within the Multi-Link Device (MLD) Block Ack (BA) session handlers. The root cause is a failure to validate that 'sta_mask' is non-zero before passing it to the ffs() function. When 'sta_mask' is zero, ffs() returns 0, and the subsequent subtraction results in an integer wrap-around to 0xFFFFFFFF. This value is then used as an index for the 'fw_id_to_link_sta[]' array, leading to an out-of-bounds read/write. The vulnerability is addressed by adding WARN_ON_ONCE guards to ensure 'sta_mask' is validated before use. Patches are available in kernel versions 6.18.38, 7.1.3, and 7.2-rc1.
Affected products
- Linux Linux Kernel 6.18.38, 7.1.3, 7.2-rc1
Timeline
- 2026-07-24: disclosed
- 2026-07-24: advisory