The vulnerability originates from the iwlwifi driver in the Linux kernel, where several Block ACK (BA) session handlers derive a station ID by calling ffs(ba_data->sta_mask) – 1 without checking that sta_mask is non‑zero. When sta_mask is zero, ffs() returns zero, the subtraction underflows to 0xFFFFFFFF, and the resulting index causes an out‑of‑bounds read on the fw_id_to_link_sta array. This missing input validation can corrupt kernel memory and lead to a crash (denial of service). The weakness is an unchecked return value that leads to an out‑of‑bounds read, involving both CWE‑823 and CWE‑125.

This flaw affects all Linux kernel builds that include the iwlwifi driver before the patch that adds WARN_ON_ONCE guards, including the stable and long‑term support releases that have not yet incorporated the commit referenced in the advisory. Any system running such a kernel is potentially exposed.

The EPSS score is below 1 % and the vulnerability is currently not listed in CISA KEV, indicating a low probability of exploitation in the wild. However, if an attacker can place themselves within range of the affected Wi‑Fi hardware and send crafted BA session frames, they could trigger an out‑of‑bounds access and crash the kernel. Based on the description, it is inferred that the attack vector is network‑based, originating from a nearby malicious device or rogue access point, and requires that the victim device is using the vulnerable iwlwifi driver with BA sessions enabled.