The flaw originates in the iwlwifi driver of the Linux kernel. A TID value supplied by the firmware (ba_notif->tid) is used directly as an array index into tid_data[] without any bounds checking. This unchecked array index allows an attacker to read or write memory beyond the intended bounds of the array, which can corrupt kernel memory, cause crashes, or potentially be exploited for arbitrary code execution. The weakness is a classic out‑of‑bounds array access represented by CWE‑125.

Linux kernel users running the iwlwifi driver before the commit that added this bounds check are affected. No specific kernel version range was provided by the CNA, so any kernel build that contains the vulnerable code path remains at risk. The product is the Linux kernel; the vendor is Linux.

The CVSS score of 5.5 places the vulnerability in the medium severity category. Its EPSS score is less than 1 %, indicating a low probability of exploitation in the wild. The issue is not listed in CISA’s KEV catalog, and no public exploit has been documented. Based on the description, the likely attack vector involves manipulating firmware messages sent to the Wi‑Fi device, which would constrain the threat to local or highly privileged actors. Until an exploit becomes available, the overall risk can be considered moderate.