An out-of-bounds array index occurs when the iwlwifi mvm driver processes a BA window status notification from firmware. The driver extracts a 5-bit sta_id value and uses it directly as an index into the fw_id_to_mac_id[] array without performing bounds checking. This unchecked indexing can corrupt kernel memory, giving a successful attacker the possibility to gain elevated privileges or otherwise compromise system integrity. The weakness corresponds to out-of-bounds read (CWE-125).

This issue affects any Linux kernel installation that includes the iwlwifi wireless driver before the patch that adds bounds checking. All distributions that ship the unpatched driver are potentially vulnerable, since the vendor and downstream kernel releases have yet to apply the fix.

The CVSS score of 8.8 reflects high severity, and the EPSS score of less than 1% indicates a very low but non-zero likelihood of exploitation, while the kernel remains not listed in KEV. The likely attack vector is a hostile access point sending malformed BA window status notifications over the air, which triggers the iwlwifi driver to process the notification. Because the driver does not perform bounds checking on the extracted sta_id, a crafted notification can index fw_id_to_mac_id[] out of bounds, potentially corrupting kernel memory or causing out-of-bounds read (CWE-125). This scenario presents a low barrier to exploitation once wireless networking is enabled and the attacker can transmit to the target device.