Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a out-of-bound check before accessing the array.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-24T17:17:11.710Z",
  "pubdate": "2026-09-24T17:17:11.710Z",
  "executiveSummary": "The vulnerability is an out-of-bounds (OOB) memory access within the Linux kernel's iwlwifi mvm (MAC80211 Virtual Management) driver. This defect occurs during the processing of Block Acknowledgement (BA) notifications.\nThe root cause is an improper array indexing operation where the driver uses a loop counter instead of the designated Traffic Identifier (TID) value to index the mvmsta->tid_data array.\nWhile the current implementation constraints (lack of multi-TID blockack usage) effectively limit the loop counter to zero, rendering the issue benign in standard configurations, the flaw represents a logic error in memory management.\nAn attacker capable of influencing the TFD (Transmit Frame Descriptor) loop conditions or state could potentially trigger an OOB write, leading to memory corruption, kernel instability, or potential arbitrary code execution within the kernel context.\nThe impact is localized to systems utilizing affected iwlwifi wireless chipsets. Exploitation requires the ability to interact with the Wi-Fi stack and trigger specific BA notification sequences, which typically necessitates local network access.\nThis vulnerability highlights a critical failure in input validation when handling management frame parameters, emphasizing the necessity for strict bounds checking in driver-level data structure access.",
  "technicalDetails": "The vulnerability resides within the iwlwifi wireless driver, specifically in the function responsible for processing Block Acknowledgement (BA) notifications. The logic failed to correctly map the data structure access to the appropriate Traffic Identifier (TID).\nIn the affected codebase, the structure mvmsta->tid_data is meant to be indexed by the 'tid' value to retrieve or store specific link quality (lq_color) parameters. However, the implementation incorrectly utilized the TFD (Transmit Frame Descriptor) loop counter 'i' as the array index.\nThe execution flow typically follows a notification sequence where the driver parses the BA entry. During this phase, the driver iterates through the TFDs. Because the logic erroneously used the loop index 'i' to reference tid_data, any value of 'i' that exceeds the bounds of the tid_data array—or simply deviates from the intended TID—results in an out-of-bounds memory operation.\nIf 'i' were to increment beyond the size of the tid_data array, the kernel would perform an out-of-bounds write, overwriting adjacent memory locations with lq_color information. This effectively corrupts the kernel heap or data segment adjacent to the mvmsta structure.\nUnder normal operating conditions, the driver configuration does not currently support multi-TID blockack, constraining the TFD loop counter 'i' to 0. This constraint acts as a natural mitigation, preventing the out-of-bounds index from exceeding the bounds of the tid_data array in current deployments. However, this is a brittle defense based on implementation side effects rather than robust input validation.\nExploitation would require an attacker to craft specific 802.11 management frames that trigger the BA notification path while manipulating the system state to allow 'i' to increment past the expected bounds. If successful, the attacker could perform a 'write-what-where' primitive, potentially overwriting function pointers or sensitive kernel objects, leading to a kernel panic or privilege escalation.\nThe patch introduces an explicit boundary check to ensure that the index used for tid_data is strictly validated against the size of the array, preventing any access if the index is out-of-bounds, regardless of the loop counter state."
}