A potential out-of-bounds read vulnerability in the Linux kernel iwlwifi wireless driver allows adjacent attackers to trigger information disclosure or system denial of service.

This is an out-of-bounds read flaw caused by inadequate validation of dynamic array sizes during memory copy operations within the iwl_mvm_nd_match_info_handler function. An unauthenticated attacker positioned on the adjacent network can exploit this flaw with low attack complexity.

A successful exploit of this vulnerability can lead to unauthorized disclosure of sensitive kernel memory contents or cause system instability resulting in a denial of service. The CVSS score of 8.1 reflects the severe potential impact on confidentiality and availability, although the attack vector requires adjacent network access. This poses significant risk to environments relying on affected wireless networking hardware.

Immediate Action: Update the Linux kernel to the appropriate fixed stable releases, such as version 6.1.168, 6.6.134, 6.12.81, or later depending on the active branch.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or driver-related errors associated with the iwlwifi wireless subsystem.

Compensating Controls: Restrict physical and adjacent wireless network access to trusted personnel and devices to mitigate the risk of exploitation.

Public Exploit Available: No

System administrators must treat this high-severity kernel vulnerability with urgency and schedule maintenance windows to apply the upstream patches. Updating the Linux kernel to the latest stable versions is critical to fully remediate the underlying memory safety flaw and protect system availability.