CVE-2026-31779

What it actually does

This is an out-of-bounds read vulnerability in the Linux kernel Intel Wi-Fi driver path, specifically the iwlwifi MVM notification handling logic in iwl_mvm_nd_match_info_handler(). The vulnerable code can copy more bytes from notif->matches than are actually present in the received notification buffer, causing results->matches to be populated with data read beyond the intended bounds. At a technical level, this may expose adjacent kernel memory contents or trigger a kernel fault depending on memory layout, compiler hardening, and runtime sanitizers. The CVSS vector indicates adjacent-network attack surface, no authentication, no user interaction, high confidentiality impact, and high availability impact; exploitation requires proximity to the affected Wi-Fi interface rather than Internet reachability.

Why it matters to the business

Systems using affected Linux kernels with the Intel iwlwifi driver may be vulnerable to an attack from Wi-Fi range that can crash the system or potentially expose sensitive kernel memory. Operationally, this is most relevant to laptops, workstations, embedded Linux devices, kiosks, and servers using Intel wireless adapters. Although EPSS is currently very low at 0.00271 with no 30-day increase, there is no known public exploit maturity, and it is not listed in CISA KEV or ransomware use, the issue still warrants remediation because it affects kernel code and can be triggered without local credentials when an attacker is physically nearby.

How an attack unfolds

An attacker first positions themselves within wireless range of a vulnerable Linux system using an affected Intel Wi-Fi adapter and kernel driver. They then cause the wireless stack to process crafted or malformed Wi-Fi-related input that leads the iwlwifi MVM code to handle a notification whose match count or match data length is inconsistent with the actual packet length. Because the vulnerable memcpy path assumes notif->matches contains enough bytes, the kernel can read past the end of the provided match array and copy unintended adjacent memory into the destination result structure. Depending on how that copied data is later used, the attacker may obtain information disclosure, destabilize the wireless driver, or cause a kernel crash. There are currently no named threat actors, KEV listing, ransomware association, or public exploit maturity reported for this CVE.

How to fix it

Apply a Linux kernel update from the relevant operating system or distribution vendor that includes the upstream iwlwifi MVM bounds-check fix for iwl_mvm_nd_match_info_handler(). No exact fixed package versions were provided in the input, so remediation should be tracked through vendor advisories and kernel changelogs for the affected distribution. Where immediate patching is not possible, reduce exposure by disabling Wi-Fi on affected systems, unloading or blacklisting the iwlwifi driver where operationally feasible, using wired networking, disabling unused wireless interfaces, and restricting use of affected devices in untrusted wireless environments. Reboot systems after kernel updates so the fixed kernel and driver code are actually loaded.

How to confirm the fix worked

Confirm exposure by checking whether the system uses an Intel wireless adapter driven by iwlwifi and whether the running kernel predates the vendor kernel containing the fix. Validate remediation by confirming the running kernel version after reboot, not only the installed package version. Where source or vendor patch metadata is available, verify that iwl_mvm_nd_match_info_handler() includes packet-length validation sufficient to ensure notif->matches contains the number of bytes copied. On representative systems, confirm that the iwlwifi module in use is from the updated kernel build. Security teams can also monitor kernel logs after patching to ensure prior iwlwifi crashes, KASAN reports, or firmware error loops no longer recur under normal wireless use.

Typical attack path

1. Identify a target device running a vulnerable Linux kernel with an Intel iwlwifi-supported wireless adapter enabled.
2. Move within adjacent wireless range of the target device; remote Internet access alone is not sufficient for the CVSS-described attack path.
3. Transmit crafted Wi-Fi traffic or otherwise induce malformed driver/firmware notification handling that reaches the iwl_mvm_nd_match_info_handler() code path.
4. Trigger the insufficient packet-length validation so the kernel copies beyond the valid notif->matches buffer.
5. Leverage the result as a kernel memory disclosure primitive or cause driver/kernel instability leading to denial of service.
6. Optionally repeat the trigger to collect more leaked data or to force repeated crashes and operational disruption.

How to detect it

Evidence of exploitation is likely to be indirect because the vulnerability is an out-of-bounds read in kernel Wi-Fi driver handling and may not leave application-layer artifacts. Review kernel logs, system journals, crash dumps, pstore records, and endpoint telemetry for iwlwifi, iwlmvm, or mac80211 errors occurring near suspicious wireless activity or repeated device instability. Useful log sources include journalctl -k output, /var/log/kern.log, /var/log/messages, /var/log/syslog, systemd-coredump metadata, kdump/vmcore artifacts, pstore/ramoops entries, and EDR kernel panic telemetry. Look for KASAN, UBSAN, page fault, general protection fault, kernel BUG, WARNING, firmware crash, Microcode SW error, or transport error messages referencing iwlwifi, iwlmvm, or iwl_mvm_nd_match_info_handler(). Because no public exploit, KEV entry, ransomware use, or named actor activity is currently known, absence of these logs does not prove absence of attempted exploitation; it only means no obvious crash/sanitizer artifact was observed. For forensic triage, correlate suspicious kernel events with Wi-Fi association history, BSSID changes, public wireless usage, and proximity-based incidents.

• iwl_mvm_nd_match_info_handler
• iwlwifi
• iwlmvm
• KASAN: slab-out-of-bounds
• KASAN: out-of-bounds
• BUG: KASAN
• general protection fault
• kernel BUG
• BUG: unable to handle page fault
• WARNING: CPU:
• Microcode SW error detected
• Loaded firmware version
• iwlwifi .* firmware crashed
• iwlwifi .* Failed to start RT ucode
• iwlwifi .* Queue .* stuck
• iwlwifi .* Start IWL Error Log Dump
• iwlwifi .* Transport status
• mac80211
• /var/log/kern.log
• /var/log/syslog
• /var/log/messages
• /sys/fs/pstore
• /proc/modules

What your security team should do

• Prioritize patching Linux laptops, workstations, kiosks, and embedded devices that use Intel Wi-Fi adapters and regularly operate on untrusted or public wireless networks.
• Inventory systems loading the iwlwifi kernel module and correlate them with kernel versions covered by vendor advisories for this fix.
• If patching is delayed, disable Wi-Fi or unload/blacklist iwlwifi on higher-risk systems where wireless connectivity is not required.
• Monitor kernel logs, crash dumps, and EDR telemetry for iwlwifi-related crashes or KASAN out-of-bounds read reports, especially on devices used in public spaces.
• Treat repeated unexplained wireless-driver crashes as potentially suspicious until ruled out, even though there is no current KEV listing, ransomware association, named threat actor activity, or public exploit maturity.
• Ensure kernel updates are followed by reboots so systems are not left running vulnerable in-memory kernel code.
• Track distribution-specific fixed versions because no universal fixed version was provided for the affected Linux kernel packages.