A flaw was found in the iwl_mvm_nd_match_info_handler function of the iwlwifi driver. The memcpy call assumes that the dynamic array notif->matches is large enough for the number of bytes to be copied. If this assumption fails, the function copies data past the end of the array, causing an out-of-bounds read. The result is that sensitive kernel information may be exposed to an attacker, classifying the weakness under CWE-20: Improper Input Validation.

The vulnerability affects Linux kernels that include the iwlwifi driver before the patch referenced by commits 744fabc… and ca0e949…. Any distribution that shipped a kernel prior to these commits is potentially vulnerable. The exact kernel version range is not listed in the advisory, but any kernel installing iwlwifi without the fix is at risk.

EPSS data is not available and the vulnerability is not listed in KEV, so the publicly reported exploitation probability is unknown. However, the flaw requires the delivery of crafted WiFi packets to a target machine, making the attack vector remote and dependent on wireless traffic control. While the attack may be complex, the read of kernel memory could expose confidential data, and the lack of mitigation outside the kernel suggests that patching remains the prudent course of action.