iwlwifi StaId OOB

Vulnerability analysis

The Intel WiFi driver processes firmware notifications that report the status of Block Ack windows by extracting a station identifier and using it to look up an internal array without verifying that the identifier is among the currently configured stations. A malformed notification can therefore cause the driver to read a pointer from outside the array bounds and then dereference it, leading to a kernel crash or access to unrelated kernel memory. The fix validates the station identifier before the array lookup, rejecting out-of-range values and ignoring the invalid notification instead of dereferencing a stale or arbitrary pointer. An attacker within WiFi radio range can trigger this code path by sending frames that cause the firmware to deliver such a notification; no authentication or local privileges are required, and any device with an Intel WiFi adapter using the iwlwifi driver and WiFi enabled is affected.