The iwlwifi driver in the Linux kernel incorrectly passes a q_head pointer to the iwl_mei_write_cyclic_buf function instead of the intended cldev structure. This mistake can cause the driver to read or write kernel memory it does not own, potentially leading to kernel memory corruption, crashes, or, if an attacker can influence the data passed to the driver, arbitrary code execution. The failure is triggered when wireless management frames invoke the buffer write routine that uses the wrong pointer.

All Linux kernel releases that include the iwlwifi driver are affected. The bug is present in the kernel source code for iwlwifi and is not limited to any specific version; any distribution shipping the stock kernel with the Intel wireless driver could be impacted unless it has already applied the patch.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is inferred: an attacker would need to transmit carefully crafted Wi‑Fi traffic that triggers the erroneous buffer write routine, or otherwise obtain local privilege to drive the driver into the buggy code path.