KernelScan.io

HIGH Introduced in 2.6.12

iwlwifi P2PBinding Crash

CVE-2026-97432

CVSS 7.7 / 10.0 KernelScan AI

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

01

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix P2P-Device binding handling Our binding handling for P2P-Device can run into the following scenario, as observed by our testing: - a station interface is connected on some channel - the P2P-Device does a remain-on-channel (ROC) on that channel - the ROC ends, and the P2P-Device is removed from the binding, but the phy_ctxt pointer is left around as a PHY cache so we don't need to recalibrate to the channel again and again in case it's not shared - a binding update by the station interface, even a removal, will re-add the P2P-Device to the binding - the P2P-Device is removed, which removes the PHY context, but it's still in the binding so the firmware crashes Since the P2P device is removed from the binding and only re- added by unrelated code, but we want to keep the phy_ctxt around as a cache for future ROC usage, fix it by adding a boolean that indicates whether or not the P2P-Device should be added to the binding, and handle that in the binding iterator. That way, the station interface cannot re-add the P2P-Device to the binding when that isn't active.

02

Engine v0.6.0

Risk summary

A logic error in the Intel iwlwifi WiFi driver causes the firmware to crash when a P2P-Device remain-on-channel operation is followed by a station interface binding update. Any local user who can control WiFi interfaces — including unprivileged users on systems with user namespaces enabled — can trigger this denial of service. Systems without Intel WiFi hardware are unaffected.

Affecteddrivers/net/wireless/intel/iwlwifi/mvm/binding.c (iwlwifi mvm)

Vulnerability analysis

When a P2P-Device remain-on-channel operation ends, the driver removes the P2P-Device from its channel binding but keeps the PHY context pointer cached for future use. A subsequent binding update by an unrelated station interface on the same channel incorrectly re-adds the P2P-Device to the binding. Later, when the P2P-Device is torn down, it frees the PHY context while it is still referenced by the binding, causing the WiFi firmware to crash. The fix introduces a flag that tracks whether a P2P-Device should participate in the binding, and the binding iterator now skips P2P-Device interfaces that are not actively in a binding, preventing station interface operations from re-adding them. The vulnerable path is reachable from a local process with WiFi configuration privileges (CAP_NET_ADMIN), obtainable by an unprivileged user through user namespaces on most distributions, and requires Intel WiFi hardware using the iwlwifi driver.

03

BranchIntroducedFixed inPatch commit
6.122.6.126.12.1147be2fc679c8f
6.182.6.126.18.53b74e377cad92
6.56.5.126.68575514a9794
6.66.6.26.6.16050bf37362362
mainline2.6.127.2—

04

State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.

CIP treeState
cip/6.12Affected — no CIP fix yet (latest 6.12.112-cip33)
cip/6.1Affected — no CIP fix yet (latest 6.1.189-cip61)
cip/6.1-rtAffected — no CIP fix yet (latest 6.1.189-cip61-rt32)
cip/5.10Affected — no CIP fix yet (latest 5.10.271-cip78)
cip/5.10-rtAffected — no CIP fix yet (latest 5.10.268-cip77-rt34)
cip/4.19Affected — no CIP fix yet (latest 4.19.325-cip136)
cip/4.19-rtAffected — no CIP fix yet (latest 4.19.325-cip136-rt50)
cip/4.4Affected — no CIP fix yet (latest 4.4.302-cip115)
cip/4.4-rtAffected — no CIP fix yet (latest 4.4.302-cip115-rt63)