The vulnerability is a flaw in the Linux kernel Wi‑Fi driver that incorrectly validates the layout of TX_CMD responses. The driver counts frame entries based on an untrusted frame_count value and then reads additional data without ensuring the packet is correctly sized. An attacker could craft a malformed TX_CMD response that causes the driver to read beyond the intended bounds or otherwise corrupt kernel memory, leading to a kernel Oops or crash. This would result in a denial of service on the affected system. The flaw corresponds to improper input validation (CWE-20) and out‑of‑bounds read (CWE-125).

All Linux kernels that include the iwlwifi driver and have not yet incorporated the commit that adds proper validation to TX_CMD parsing. No specific version range is listed, so any kernel build using the default kernel sources may be vulnerable until the patch is applied.

The revised check limits frame_count to the value expected by the current runtime layout; however no public exploit or EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.8 indicates a high severity. The attack vector is inferred to be via crafted wireless frames sent to the Wi‑Fi interface, which may require a physical or network proximity to the target. Because the flaw involves kernel memory parsing, successful exploitation could lead to a local or remote denial of service but is unlikely to provide direct code execution without additional conditions. The lack of a published exploit suggests the risk is moderate, though patching is advisable to prevent potential crash from malformed traffic.