CVE-2026-31779wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() The memcpy function assumes the dynamic array notif->matches is at least as large as the number of bytes to copy. Otherwise, results->matches may contain unwanted data. To guarantee safety, extend the validation in one of the checks to ensure sufficient packet length. Found by Linux Verification Center (linuxtesting.org) with SVACE.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c before f6abac936a0dfd31d6c3e49205ec0ee75a8f887f; from 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c before ffbed27ba15ef80d1c622eeedbfef03e501ae134; from 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c before e67d8c626ace80b0fa2b48c8ec0a46b508c93442; from 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c before dd90880eb5ec5442b37eb2b95688f4a63f4883e3; from 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c before ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2; from 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c before 744fabc338e87b95c4d1ff7c95bc8c0f834c6d99 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.1 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0; 7.0; 7.0; and 3 more ranges | NVD |
References
- https://git.kernel.org/stable/c/f6abac936a0dfd31d6c3e49205ec0ee75a8f887fpatch
- https://git.kernel.org/stable/c/ffbed27ba15ef80d1c622eeedbfef03e501ae134patch
- https://git.kernel.org/stable/c/e67d8c626ace80b0fa2b48c8ec0a46b508c93442patch
- https://git.kernel.org/stable/c/dd90880eb5ec5442b37eb2b95688f4a63f4883e3patch
- https://git.kernel.org/stable/c/ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2patch
- https://git.kernel.org/stable/c/744fabc338e87b95c4d1ff7c95bc8c0f834c6d99patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.