Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate sta_id in BA window status notif BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the firmware notification and uses it to index fw_id_to_mac_id[] without bounds checking. Validate sta_id before array access to prevent out-of-bounds indexing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-24T17:17:12.720Z",
  "pubdate": "2026-09-24T17:17:12.720Z",
  "executiveSummary": "The Linux kernel iwlwifi driver is susceptible to an out-of-bounds (OOB) memory access vulnerability within the mvm layer.\nThe flaw originates from insufficient input validation when processing BA_WINDOW_STATUS_NOTIFICATION_ID notifications received from the firmware.\nAn attacker capable of influencing firmware-to-host communications can trigger this vulnerability by providing a crafted 5-bit sta_id value.\nThis value is used as an index for the fw_id_to_mac_id[] array without verification, leading to an OOB read or potentially an OOB write, depending on the compiler's memory layout and downstream operations.\nThe primary impact involves potential kernel memory corruption or an information leak, which can lead to a system-wide denial-of-service (crash) or the bypass of security memory protections.\nThe vulnerability is present in the wireless subsystem, specifically affecting the Intel wireless drivers (iwlwifi). Exploitation generally requires the attacker to be in a position to influence the wireless firmware state or intercept the notification flow, making it a critical concern for kernel-level stability.",
  "technicalDetails": "The vulnerability exists within the iwlwifi driver's handling of the BA_WINDOW_STATUS_NOTIFICATION_ID notification, which is intended to provide status updates regarding Block Acknowledgement (BA) windows.\nThe root cause is an improper bounds check on the sta_id parameter, which is extracted from the notification payload. Although the sta_id is defined as a 5-bit value, the driver fails to validate that the provided integer falls within the valid index range of the fw_id_to_mac_id[] array.\nIn the Linux kernel's iwlwifi architecture, fw_id_to_mac_id[] serves as a lookup table mapping firmware-specific station identifiers to internal MAC addresses. When the firmware sends a BA_WINDOW_STATUS_NOTIFICATION_ID, the driver invokes internal handling functions that utilize this sta_id to access this array.\nBecause there is no bounds checking enforced before the array access, an attacker or a malicious firmware image can provide a value larger than the allocated array size. This results in the driver performing a memory access outside the intended buffer boundaries.\nThe attack flow begins when the wireless firmware triggers a BA_WINDOW_STATUS_NOTIFICATION_ID. If an attacker can influence the contents of this notification (e.g., through physical proximity or by compromising the wireless device firmware), they can supply an arbitrary 5-bit value. The driver consumes this value, calculates an address based on the array's base pointer and the offset, and performs a memory access. If the offset is high enough, it accesses arbitrary kernel memory.\nThe post-exploitation impact includes the potential for kernel heap or stack corruption. If the OOB access involves reading, sensitive information from kernel space could be exposed. If the access involves writing, the attacker may overwrite adjacent kernel structures, potentially gaining control over execution flow or triggering an immediate kernel panic, leading to a denial-of-service condition.\nThe vulnerable code component is located within the mvm (Multi-interface MAC) layer of the iwlwifi driver. The vulnerability remains present in kernel versions that lack the specific sanity checks for sta_id prior to the array index calculation."
}