The iwlwifi driver parses firmware TLVs using ALIGN(tlv_len, 4) without first confirming that the aligned value is within the remaining data length. This miscalculation can cause a length underflow that permits a crafted firmware image to manipulate the parsing logic. As a result, the driver may read or write beyond the intended buffer boundaries. Based on the description, it is inferred that the vulnerability may lead to memory corruption that could allow arbitrary code execution or privilege escalation on the host system.

All Linux kernel implementations that ship the legacy iwlwifi driver are affected. No explicit release range is identified, so any kernel that contains the vulnerable firmware parsing logic before the commit 528fa9eb and the subsequent stable revisions remains vulnerable. The fix is included in kernel commits referenced in the provided links.

With a CVSS score of 5.5 the vulnerability is classified as moderate severity. The EPSS score of less than 1 % and the absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. However, the flaw requires the ability to supply a malformed firmware image, implying local or privileged access to the machine. If an attacker can inject malicious firmware, the resulting memory corruption could yield arbitrary code execution. Overall, the risk is moderate, with limited immediate threat in the absence of privileged firmware injection capability.