Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TX_CMD response layout TX_CMD parsing uses frame_count to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing the payload. For new TX API, reject TX_CMD responses with frame_count != 1 and warn/return in the aggregation handler to document that aggregated accounting is expected via BA notifications.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-24T17:17:12.050Z",
  "pubdate": "2026-09-24T17:17:12.050Z",
  "executiveSummary": "This vulnerability involves improper input validation within the Linux kernel's iwlwifi driver, specifically affecting the MVM (Multi-root Virtual Machine) layer's handling of TX_CMD responses.\nThe flaw allows for a discrepancy between the expected memory layout of TX_CMD response packets and the actual parsing logic used to traverse frame status entries and SCD (Scheduler Command Descriptor) sequence numbers.\nAn attacker capable of influencing the wireless hardware response or injecting malicious firmware/data could potentially trigger out-of-bounds memory access or logic errors during status parsing.\nThe risk is primarily categorized as an information disclosure or potential memory corruption vulnerability, depending on the kernel's memory safety state during the malformed packet processing.\nAffected systems include Linux kernel environments utilizing the iwlwifi wireless driver subsystem. Successful exploitation requires an attacker to interact with the device's communication path, typically necessitating proximity to the wireless radio or control over the firmware-driver interface.\nMitigation involves enforcing strict length validation and frame count verification prior to memory traversal to ensure the response buffer matches the expected architectural constraints.",
  "technicalDetails": "The vulnerability resides in the iwlwifi MVM layer's parsing logic for TX_CMD response frames. The driver uses a 'frame_count' field to iterate through status entries within the response payload, subsequently attempting to read a trailing SCD Sequence Serial Number (SSN).\nThe root cause is a failure in the initial minimum-length validation checks. Historically, the code failed to synchronize the bounds check performed at the entry of the parsing function with the actual dynamic layout logic used later in the execution flow. This mismatch allowed the driver to attempt to access memory beyond the actual length of the provided response buffer if the frame_count was manipulated.\nIn the context of the newer TX API implementation, the driver now explicitly requires that TX_CMD responses contain a frame_count exactly equal to one. Previously, ambiguous or excessive frame counts could cause the pointer arithmetic logic to advance into unauthorized memory segments, potentially leading to kernel panics, information leakage, or memory corruption.\nThe attack flow involves the following sequence: 1) The host kernel issues a TX_CMD to the wireless hardware. 2) The hardware returns a response packet. 3) If an attacker can influence the response packet structure—such as through firmware compromise or by exploiting the hardware-to-driver interface—they can provide a crafted packet with a manipulated frame_count field. 4) The driver's parsing routine, failing to validate the response length against the frame_count prior to iteration, processes the forged status entries. 5) The driver attempts to read the trailing SCD SSN at an offset calculated based on the attacker-controlled frame_count, resulting in an out-of-bounds read or potential heap memory corruption.\nFurthermore, the patch introduces specific constraints for aggregated traffic. By warning and returning when aggregated responses are incorrectly routed through the standard TX_CMD handler, the kernel enforces the architectural requirement that aggregated accounting must be handled exclusively via BA (Block Acknowledgment) notifications, thereby closing the logic error path that allowed misaligned parsing of aggregated frame headers.\nThis vulnerability highlights a critical need for rigorous input sanitization in hardware-interface drivers, particularly where variable-length telemetry data is parsed directly from device-provided memory buffers without strict adherence to established interface length limits."
}