CVE-2026-43172
iwlwifi SMEM Parsing Array Overrun in Linux Kernel
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intel | iwlwifi | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's iwlwifi driver for Intel wireless devices. It occurs when the firmware incorrectly reports three LMACs (Low MACs), which do not exist in the hardware. The driver then attempts to access an array element that is out of bounds (specifically fwrt->smem_cfg.lmac[2]), causing an array overrun. The fix involves rejecting such incorrect firmware reports and replacing a warning mechanism (WARN_ON) with a more appropriate check (IWL_FW_CHECK) to handle this condition safely.
How can this vulnerability impact me? :
An array overrun in the kernel driver can lead to undefined behavior, including potential system crashes, instability, or security issues such as memory corruption. If exploited, it could allow attackers to cause denial of service or possibly execute arbitrary code with kernel privileges, depending on the context and further exploitation.