The iwlwifi driver for Intel Wi‑Fi chips contains a bug where the function iwl_mei_write_cyclic_buf() receives the wrong pointer as its first argument. Instead of the intended cldev structure, the code passes the q_head pointer. This mismatch can cause the driver to read or write memory it does not own, potentially leading to kernel memory corruption, crashes, or arbitrary code execution if the attacker can influence the function call. The vulnerability manifests when WLAN management frames trigger the buffer write routine that uses the incorrect pointer.

All Linux kernel releases that include the iwlwifi driver are affected, as the issue appears in the kernel source for iwlwifi and is not limited to a specific version. The problem applies to any distribution that ships with the stock kernel and the Intel wireless driver. No specific version list is provided in the advisory.

No CVSS score or EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly documented exploits as of this analysis. The likely attack vector is local or through crafted wireless traffic that can trigger the offending buffer write. Because the bug causes kernel memory corruption, an attacker who can control the data passed to the driver could potentially achieve privilege escalation or cause a denial of service by crashing the system.