HIGH Introduced in 4.6
iwlwifi StaId OOB
CVE-2026-93799
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate sta_id in BA window status notif BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the firmware notification and uses it to index fw_id_to_mac_id[] without bounds checking. Validate sta_id before array access to prevent out-of-bounds indexing.
02KernelScan AI Analysis
Risk summary
An attacker within WiFi range of a device using an Intel WiFi adapter (iwlwifi driver) can trigger an out-of-bounds array access in the kernel by sending frames that cause the firmware to emit a Block Ack window status notification with an invalid station ID. This can lead the driver to dereference an attacker-influenced pointer, enabling disclosure of sensitive kernel memory, corruption of kernel objects, or a kernel panic. Any device with WiFi enabled and Intel wireless hardware is potentially exposed.
Vulnerability analysis
The Intel WiFi driver processes firmware notifications that report the status of Block Ack windows by extracting a station identifier and using it to look up an internal array without verifying that the identifier is among the currently configured stations. A malformed notification can therefore cause the driver to read a pointer from outside the array bounds and then dereference it, leading to a kernel crash or access to unrelated kernel memory. The fix validates the station identifier before the array lookup, rejecting out-of-range values and ignoring the invalid notification instead of dereferencing a stale or arbitrary pointer. An attacker within WiFi radio range can trigger this code path by sending frames that cause the firmware to deliver such a notification; no authentication or local privileges are required, and any device with an Intel WiFi adapter using the iwlwifi driver and WiFi enabled is affected.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 4.6 | 6.6.158 | f9938eb95e2d |
| 6.12 | 4.6 | 6.12.111 | bb08fbbbd556 |
| 6.18 | 4.6 | 6.18.53 | e35ae757c646 |
| mainline | 4.6 | 7.2 | 6aa77efaea9e |
| cip/6.12 | 4.6 | 6.12.111-cip32 | bb08fbbbd556 |