Executive brief
A bug in Intel's WiFi driver (iwlwifi) causes a loop counter to overflow when the firmware reports more than 255 diagnostic entries. This can trigger an infinite loop or cause the driver to read beyond allocated memory, leading to system instability or kernel crashes on systems using Intel WiFi adapters.
Technical details
The vulnerability is an integer overflow in the iwl_fwrt_dump_error_logs() function in drivers/net/wireless/intel/iwlwifi/fw/dump.c. A loop counter 'count' was declared as u8 (0–255 range) while the number of PC entries (num_pc) is u32. When firmware advertises more than 255 PC entries, the counter wraps to zero, causing an infinite loop or out-of-bounds memory read of the pc_data array. The fix changes the counter declaration from u8 to u32 to match num_pc. This is a denial-of-service condition triggered by malformed or adversarial firmware responses.
Affected products
- Linux Linux kernel multiple versions prior to fixes in 2026-07-16
Timeline
- 2026-07-15: other: Fix committed to kernel
- 2026-09-17: disclosed: Vulnerability published as CVE-2026-93065