A flaw was found in the iwl_mvm_nd_match_info_handler function of the iwlwifi driver. The memcpy call assumes that the dynamic array notif->matches is large enough for the number of bytes to be copied. If this assumption fails, the function copies data past the end of the array, causing an out-of-bounds read. The result is that sensitive kernel information may be exposed to an attacker, classifying the weakness under CWE-125: Out-of-Bounds Read and CWE-805: Buffer Access with Incorrect Length Value.

The vulnerability affects Linux kernels that include the iwlwifi driver before the patch referenced by commits 744fabc… and ca0e949…. Any distribution that shipped a kernel prior to these commits is potentially vulnerable. The exact kernel version range is not listed in the advisory, but any kernel installing iwlwifi without the fix is at risk.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in KEV, so publicly reported exploitation remains unknown. The CVSS score of 8.1 indicates a high impact. Based on the description, the likely attack vector is remote via crafted WiFi packets, though this inference is not explicitly stated in the advisory. If exploited, the out-of-bounds read could expose kernel memory contents, potentially revealing sensitive information. No known additional mitigations exist outside updating the kernel, so prompt patching remains advisable.