The iwlwifi driver contains an out‑of‑bounds array access that occurs when firmware reports three legacy MAC (LMAC) interfaces, a configuration that hardware never supports. The code incorrectly indexes fwrt->smem_cfg.lmac[2], causing a memory overrun that can corrupt adjacent kernel data. The vulnerability does not disclose a guaranteed remote execution path, but it may compromise system stability and provide an attacker with the potential to exploit kernel memory corruption.

Any Linux system using the Intel 22000 series wireless driver (iwlwifi) before the SMEM parsing fix was applied is affected. The CPE indicates all Linux kernel versions; specific vulnerable releases are not enumerated in the data, so the exposure applies to pre‑patch kernels that contain the buggy driver code.

The CVSS score of 8.8 reflects high severity, yet the EPSS score of less than 1% signals a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to influence the firmware data read by the driver, for example by supplying custom firmware. The likely attack vector is that an attacker could manipulate custom firmware loaded by the system, though this scenario is not typically viable in standard consumer deployments with signed OEM firmware. Overall, the risk is moderate for environments that load firmware from untrusted sources and low for standard consumer installations.