An out-of-bounds memory access vulnerability in the Linux kernel iwlwifi wireless driver allows adjacent attackers to compromise system confidentiality, integrity, and availability.

This vulnerability arises because three Block Acknowledgment session handlers use the ffs() function on sta_mask without verifying that the mask is non-zero, resulting in an integer wrap and out-of-bounds array access. The attack vector requires adjacent network access with no privileges or user interaction required.

A successful exploit against this kernel vulnerability can lead to severe system compromise, including denial of service, kernel panic, or potential execution of arbitrary code within the operating system. Because the CVSS score is 8.8, it represents a high severity threat that directly impacts critical infrastructure reliability and data confidentiality on affected wireless hosts.

Immediate Action: Update the Linux kernel to version 6.18.38, 7.1.3, or apply the official upstream patches provided in the vendor repository.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unexpected iwlwifi driver crashes that may indicate exploitation attempts.

Compensating Controls: Restrict wireless network access to trusted devices and segment affected wireless interfaces to limit exposure to adjacent network threats.

Public Exploit Available: No - As of Jul 24, 2026, there is no confirmation of a public exploit or active exploitation in the wild.

System administrators managing Linux environments utilizing the iwlwifi driver must prioritize applying kernel updates to patched versions as soon as possible. Prompt remediation prevents potential adjacent network attacks from causing system-wide denial of service or arbitrary memory corruption.